grandoreiro | 69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250211-es
resource tags

arch:x64arch:x86image:win10v2004-20250211-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
14/02/2025, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe
Size

5.5MB
MD5

6c1ef92690b2d4672136ac59dcdd3abf
SHA1

d0f21d7c68c0590f735b3bfa09517a231592de6a
SHA256

69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04
SHA512

ec914db73f6e2a331b6877f7c8d7093273347d1b0ce0e12484d4e2294f98d742ae265233c438589404c5fdd33a6450d13ae921e3a90f69609c0cbb5bcb3c585d
SSDEEP

98304:vyghDiIufzZIKj5Ahc3x8x/3a1UVG+5T8wNyxZnkkYOWt:vJhZuf+W1xGSUVG+x8wQZXYh

Score

10^/10

grandoreiro latentbot banker discovery persistence trojan

Malware Config

Extracted

Family

latentbot

zaf495d3a42.zapto.org

Signatures

Detects Grandoreiro payload 14 IoCs

resource	yara_rule
behavioral1/memory/3384-24-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-335-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-355-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-552-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-629-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-670-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-679-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-704-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-741-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-746-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-751-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-757-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-794-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/3384-797-0x0000000011740000-0x0000000012740000-memory.dmp	family_grandoreiro_v1

Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
trojan banker grandoreiro
Grandoreiro family
grandoreiro
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Downloads MZ/PE file 1 IoCs

flow	pid	Process
132	6004	Process not Found

Executes dropped EXE 1 IoCs

pid	Process
3384	randpp.exe

Loads dropped DLL 7 IoCs

pid	Process
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\azzxrgr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\randpp.exe"	randpp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	randpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1952	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3384	randpp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
3384	randpp.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3384	randpp.exe
3384	randpp.exe
3384	randpp.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3384	4148	69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe	93
PID 4148 wrote to memory of 3384	4148	69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe	93
PID 4148 wrote to memory of 3384	4148	69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe	93
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 5000 wrote to memory of 4392	5000	firefox.exe	98
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 3888	4392	firefox.exe	99
PID 4392 wrote to memory of 232	4392	firefox.exe	100
PID 4392 wrote to memory of 232	4392	firefox.exe	100
PID 4392 wrote to memory of 232	4392	firefox.exe	100
PID 4392 wrote to memory of 232	4392	firefox.exe	100
PID 4392 wrote to memory of 232	4392	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe
"C:\Users\Admin\AppData\Local\Temp\69a581d100d68b8ed03d9afb8672c41b121e94453da440314b9cdcdbf1421f04.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 27431 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2469185f-44d0-4e37-b131-da0427bc4196} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" gpu
    3⤵
    PID:3888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2368 -prefsLen 27309 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48ce5842-be11-40b1-94b5-0d5d114b8891} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" socket
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3052 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7e1b013-f87a-4c6a-ba9e-dcbe403dec3e} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -childID 2 -isForBrowser -prefsHandle 3736 -prefMapHandle 3732 -prefsLen 32683 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58c6c431-9dc3-4eb0-8a6c-0ad34007bcf7} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4644 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4580 -prefMapHandle 4660 -prefsLen 32683 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee7fefd4-7408-4e23-bf61-63d2387eb48e} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" utility
    3⤵
    - Checks processor information in registry
    PID:5252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 3 -isForBrowser -prefsHandle 5204 -prefMapHandle 5188 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {179150fd-042a-4d0f-9099-87ffb9f3c306} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 4 -isForBrowser -prefsHandle 5452 -prefMapHandle 5228 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36a1bcb9-281d-45e6-8e61-af92a813b02e} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a6636c3-959b-4282-8e16-e5a565e540a6} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 6 -isForBrowser -prefsHandle 3160 -prefMapHandle 6124 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79e8a9bb-9a84-43ce-ae46-70c99a73422a} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6324 -childID 7 -isForBrowser -prefsHandle 6312 -prefMapHandle 6284 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b41ed29-a694-4aae-a8f8-6085b1906365} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" tab
    3⤵
    PID:6140

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTc1REQ5MzYtQUQ2QS00RDkwLTlBNjAtNEFFQjg1NEEzMkY1fSIgdXNlcmlkPSJ7NTMxNTFCRTYtOTAwQi00MkEzLUEyOTgtQzVGOTQyMkE3REQxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTJEMDcyQzctODhERC00QzE4LUFBNUEtMkEwMkNFNkUxQkUyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTY3MDI1MzQ4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w18trynb.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
8aae1791ee4848092fe80d084abc934c

SHA1
345b997223e4b13c12b60a9b1bdf00ecc1edbd83

SHA256
360bf6c36e2ec387d67882f79dc8fe794841442ca29bc550154af9bc82cee7bc

SHA512
f7fc3da684990c32d76316a138ceb0535f23d9ee08bfbc6844a0e01ba5e089ca56de20cf81e52f89d89cb8458cc82db08fc851647f93e894d9063588dc8601e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CBSProducstInfo.dll

Filesize
692KB

MD5
6cd81e6343ab21a1d118243af54833a8

SHA1
bbe1a06bd85af7099fb111ac13d19df5f7f22cc0

SHA256
306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9

SHA512
295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DAQExp.dll

Filesize
1.4MB

MD5
b16ad0dd6c69c0c117c9d3647517786c

SHA1
825a54040c8e8dfe9ffb243796df806ee5b05708

SHA256
e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f

SHA512
23512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exe

Filesize
2.0MB

MD5
db67e9196605d61d8278e5278777c71f

SHA1
6fe39b3ace96505269745ed2b81975abb5aea647

SHA256
9b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010

SHA512
d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.ini

Filesize
4KB

MD5
3e7d1bf85c27b185a920dc26b776758e

SHA1
3623ff4e4d244d951426647b5f765dec5bbdd99a

SHA256
d5be03e38f60722dca24be527e5e97b60e383dbb6c88452964c9ce4683dcd6f5

SHA512
e744594e22afbdc8482cdcad8540ebfe8444e9e4fc093fbfe785421cb77d8543f7525327e3b5ba299194944bf45afb896f7d5688ea44f840c57e2c2460b77869

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\AlternateServices.bin

Filesize
7KB

MD5
280eb37444714d5c5b27afa48855874b

SHA1
59fafe16d4d501b17e708da763f1584649c62f59

SHA256
0c55bf63f26265c16bb55780a6052e6b7386821d2de2e42ff353dcf746fa1c8e

SHA512
074e565774de47486e72733ec35fb5cf68c6c334fa8c061a37e886fae0681ccd1cc4ba9f4575b21d83afaddc67f516534ce8f1c802c709c0d7e27e378577ac66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\AlternateServices.bin

Filesize
10KB

MD5
5e0b7af23dc3a73efae8860ac18ac773

SHA1
df83185666a3ad9fe081a1ef44f16178b8db34e2

SHA256
cc98b3b15f6c8b2efd219c38d01807b7f4eaf58d67217876466843e158cf21f7

SHA512
593d2c1b08c76590e499bf50829da8a006dc496dbd392313ab907e2a8af25f5c71493f429f7b4dfb21b317276aad73975cd1fa51192c7dadef6f8683d76f243b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\datareporting\glean\db\data.safe.bin

Filesize
20KB

MD5
63bcffef7e984f93d0a4b44253571fed

SHA1
eae4713aa6eafa84eaa7573a0b949dc32c6b29fb

SHA256
7cd88b8ce6b09bb16c1884423f2237dc8a8f70b2ac5b1f223525f6d2b9c14d0d

SHA512
c8972d10560f1a171c510f75786027d77ea21f6eac89527ae753f0262b3d01eed57066efb2b3bfb77645cc5514b60fe8d3c589ebb3abcbf80cc18fff67526d6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
85d684786718410f6c14d89549b9c129

SHA1
0eb0d663219240bdccdbc4c6302c9cd94e400347

SHA256
d84fbad9afeb2a6159cf116b43a9c20736ac90537dd2c04ab04c023d350121aa

SHA512
1aa6346477aac5bd3ffcf37bbee9127f64cfe682714508c8383953b3776383692740480d8ee7d786f9bd367ca08ea3fdf933d820e33e8b19634b285d872cbdf0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\datareporting\glean\pending_pings\21b91ac7-8958-477c-adea-a7102f3d1529

Filesize
26KB

MD5
4f59b5ba42c52dd73c4745452825deb3

SHA1
00b0472a20ec5e4fc3f11f0b46afb0d6bb28d573

SHA256
25812f0dcb3056c8a01f1df4a77c116927965f7f9adbd84904716f294a19d5a6

SHA512
0d278005a28b742ce927ddd6a2250ee98dc8f533adc55179f02b8140dd53ede3965c189d86492f3a7a2afbf042bf1ffe7e78b749a44bee71dd0e5b9beae76b67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\datareporting\glean\pending_pings\7d3e2038-e519-446f-94c6-104cfec7c4c7

Filesize
982B

MD5
da83d5529df256490b977397025b08a9

SHA1
c84a9c55250b4d5469095b334ae184afb1c76b1c

SHA256
c82bfff1f2a8907b6db3724ed11dfa11202080c579c2b04060197ba1c0e93420

SHA512
63b3731c90439785bbd57c9bdc1c9ca802b89d3e74b76dceabf3f294190f08c78eb548660c6c1c67734c49ea365305fe9bd2016c3ea301747898d159805bc053

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\datareporting\glean\pending_pings\9d90417c-a1ea-44cc-a219-eea29c6dd51d

Filesize
671B

MD5
60d11dfa5ad06e47045ee71101c5b398

SHA1
34c7293b26c6d9fc58440e8450e70d81cabd8e91

SHA256
b4d834ee66bcd3ad27519478837b9e02a57ff5dce8edeb7cf45e7350df6fcf40

SHA512
93b295a050aca798726302076a232ac6f2e5bfd543fa2b915fdb8991aac4e2a299ae85030d633fbc5ba73a958b2e02b4e3ef6555ef0c0a14c5358f0289a7b422

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\prefs-1.js

Filesize
10KB

MD5
631150c64c08b493276f1eba2c3df545

SHA1
fd6eb45a4d5a09178d6b2f80ba326146b5109cea

SHA256
881af7edae61437f623881190a7e107dc08a8b888d021d2ce8b47ff68196de49

SHA512
78dbdaeea293ec253a38dcb18faaa2668b1e2b57ed355592677a8d545ed81364d922f252aed7724e51566e7296b2d10c165042c6a657679f6b1df73fd5a7f15b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\prefs-1.js

Filesize
11KB

MD5
eea52feb1c034bf8b0abe42d7f8f2769

SHA1
c3b15c6155cca48600ef4928eda307026a2005c1

SHA256
555dfefd997f51482bab1cf441cc68dd92cd58b1511611bf9afe0758f2a6fd0c

SHA512
d206f140a734d4afee58cba3a10ccf9ff27fa133ff195882d7347de1a4120d6e9678059e09215f319cfe3bc9dceb8adbe907d815845a1f609444d8929845e013

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\prefs-1.js

Filesize
9KB

MD5
722f7c16eb3b63a752f2dd8b72e0ff75

SHA1
7319405c7d9ecc8ec6517dca0f4480a61176fd0b

SHA256
ec717f1b6cbabc4864c007fd4099f89fd04872be21b522e38e5f06500c7bc8f8

SHA512
0a254198989356d0abc03eb07a8056fbf786db2e7d3a819417092a01273b9c893f79147934cbedc94509b0d7709dc979f5f6ccd223a80f0c01e9aee1c12aeeb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\prefs.js

Filesize
10KB

MD5
33640b23d3120d27067c105c7242710b

SHA1
d4ae134c6f51d6ee3634b6df3620e306260c94e2

SHA256
5d6f109edf7e8426f77e00a57d3077e6e167296a4bb05f5700d5c460cbeb3596

SHA512
c4aeaf69ddb0a36517d2bafd8e6d7f81689d8dc107b19afc55b731dacc308d85fa11d7f026fafdfb5d9775111aef7c8828f296a23417b9e7f19d34bb6773b40d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
0622911d34e33418f6d1e8980d4009e7

SHA1
54200ac85492e2689b303fb09b51aaf6246e0378

SHA256
18f993995abc8d9c184be7bd44c0e26f627ea762a1da477c93dfc4a71cedcaae

SHA512
7d6bcd2ab3602b9620598cff713580ade255dc0c95e378e939d892e1aab5af74206d109db0cf3ad37069372066d937bcf58ce652b7c9eb6bd65c6742f2d200c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
4c1276be35832104d069a9f068e4bc7c

SHA1
aa9ccf15b4d41453627e72f729e0a1fcac6a0950

SHA256
3ce5d30923516da145b752ee76f69f184a45c68a1cbd50180ff7a66acc96d64e

SHA512
4a1cb0a4ab73f37f8ed7f9a52d22bbe329ec437bb84603c1d469088530c292ff16231d652faeb15fc160c913a3c8aa2354dc2afb3118146fa49093531b72cd2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w18trynb.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
ce6f6eaf9cef0ccca269aaca3aba8c69

SHA1
4020312e4f95c4ad9b7f4f62c15ebd09f1bc272a

SHA256
dbaf971b8d5de64cb9daaa794976c4dda0a3b89761291a5ca0d7a113fdfbeac2

SHA512
255a41b94b1217cf159ee87ff752d19f09edd6e34711cc2f0ab3524f2f1080b8b5b66d655c487b2c11040b897cc17c6c5e20ec693c954511e1573dfde35d5cf6

Download Submit
memory/3384-333-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/3384-629-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-670-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-627-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/3384-679-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-704-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-628-0x0000000000C60000-0x0000000000D18000-memory.dmp

Filesize
736KB

Download
memory/3384-552-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-355-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-335-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-741-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-744-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/3384-746-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-751-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-757-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-334-0x0000000000C60000-0x0000000000D18000-memory.dmp

Filesize
736KB

Download
memory/3384-24-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-21-0x0000000000C60000-0x0000000000D18000-memory.dmp

Filesize
736KB

Download
memory/3384-794-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download
memory/3384-797-0x0000000011740000-0x0000000012740000-memory.dmp

Filesize
16.0MB

Download