modiloader | f72ebfe6f11291393acec156f0f73b1eb5abf74761d5de8dd7b55839542c56af

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2025, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe
Size

1.9MB
MD5

fe321b9735e19a7d1d15377e30e12707
SHA1

71188b63762ebe467fa7c93a075bf2479c367b3b
SHA256

f72ebfe6f11291393acec156f0f73b1eb5abf74761d5de8dd7b55839542c56af
SHA512

d56cfe7df7dbf67ec69a716c550f43e13239c18238a6c592d52ef8a567c346dde2e7c78d6a71de76c33a0d5950c3acdea946640d7b7e6cf3c429d142a146678d
SSDEEP

49152:XWFuLZoC0CGIAOzi6UDLoV6ZtjrbPidPQADqy3:XWFuLaQ7L8QOjvPMQg

Score

10^/10

modiloader remcos yakuze firewall collection discovery persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

Yakuze Firewall

103.186.117.159:48453

pentester03.gleeze.com:28438

pentester0.accesscam.org:56796

honeypotresearchteam.duckdns.org:28453

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
WeChat.exe
copy_folder
wechats
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
sharepoint-YH5JCI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2524-81-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4260-87-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4488-79-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3412-2-0x0000000002EE0000-0x0000000003EE0000-memory.dmp	modiloader_stage2

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2524-81-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4488-79-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	2916	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation	ndpha.pif

Executes dropped EXE 4 IoCs

pid	Process
4716	ndpha.pif
3744	svchost.pif
2476	alpha.pif
736	aken.pif

Loads dropped DLL 1 IoCs

pid	Process
3744	svchost.pif

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	colorcpl.exe
Key opened	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	colorcpl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zhpymxci = "C:\\Users\\Public\\Zhpymxci.url"	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4488	4988	colorcpl.exe	131
PID 4988 set thread context of 2524	4988	colorcpl.exe	132
PID 4988 set thread context of 4260	4988	colorcpl.exe	134
PID 4988 set thread context of 2612	4988	colorcpl.exe	143
PID 4988 set thread context of 4896	4988	colorcpl.exe	144
PID 4988 set thread context of 1780	4988	colorcpl.exe	145

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ndpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4260	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
736	aken.pif
736	aken.pif
4488	colorcpl.exe
4488	colorcpl.exe
4260	colorcpl.exe
4260	colorcpl.exe
4488	colorcpl.exe
4488	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe
1780	colorcpl.exe
1780	colorcpl.exe
2612	colorcpl.exe
2612	colorcpl.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4988	colorcpl.exe
4988	colorcpl.exe
4988	colorcpl.exe
4988	colorcpl.exe
4988	colorcpl.exe
4988	colorcpl.exe
4988	colorcpl.exe
4988	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	aken.pif
Token: SeDebugPrivilege	4260	colorcpl.exe
Token: SeDebugPrivilege	1780	colorcpl.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3860	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	92
PID 3412 wrote to memory of 3860	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	92
PID 3412 wrote to memory of 3860	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	92
PID 3412 wrote to memory of 2128	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	94
PID 3412 wrote to memory of 2128	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	94
PID 3412 wrote to memory of 2128	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	94
PID 2128 wrote to memory of 2916	2128	cmd.exe	96
PID 2128 wrote to memory of 2916	2128	cmd.exe	96
PID 2128 wrote to memory of 2916	2128	cmd.exe	96
PID 2128 wrote to memory of 4716	2128	cmd.exe	97
PID 2128 wrote to memory of 4716	2128	cmd.exe	97
PID 2128 wrote to memory of 4716	2128	cmd.exe	97
PID 4716 wrote to memory of 3744	4716	ndpha.pif	98
PID 4716 wrote to memory of 3744	4716	ndpha.pif	98
PID 3744 wrote to memory of 4480	3744	svchost.pif	99
PID 3744 wrote to memory of 4480	3744	svchost.pif	99
PID 4480 wrote to memory of 3912	4480	cmd.exe	101
PID 4480 wrote to memory of 3912	4480	cmd.exe	101
PID 4480 wrote to memory of 3928	4480	cmd.exe	102
PID 4480 wrote to memory of 3928	4480	cmd.exe	102
PID 4480 wrote to memory of 324	4480	cmd.exe	103
PID 4480 wrote to memory of 324	4480	cmd.exe	103
PID 4480 wrote to memory of 2476	4480	cmd.exe	104
PID 4480 wrote to memory of 2476	4480	cmd.exe	104
PID 2476 wrote to memory of 736	2476	alpha.pif	105
PID 2476 wrote to memory of 736	2476	alpha.pif	105
PID 3412 wrote to memory of 4988	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	117
PID 3412 wrote to memory of 4988	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	117
PID 3412 wrote to memory of 4988	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	117
PID 3412 wrote to memory of 4988	3412	Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe	117
PID 4988 wrote to memory of 4472	4988	colorcpl.exe	130
PID 4988 wrote to memory of 4472	4988	colorcpl.exe	130
PID 4988 wrote to memory of 4472	4988	colorcpl.exe	130
PID 4988 wrote to memory of 4488	4988	colorcpl.exe	131
PID 4988 wrote to memory of 4488	4988	colorcpl.exe	131
PID 4988 wrote to memory of 4488	4988	colorcpl.exe	131
PID 4988 wrote to memory of 4488	4988	colorcpl.exe	131
PID 4988 wrote to memory of 2524	4988	colorcpl.exe	132
PID 4988 wrote to memory of 2524	4988	colorcpl.exe	132
PID 4988 wrote to memory of 2524	4988	colorcpl.exe	132
PID 4988 wrote to memory of 2524	4988	colorcpl.exe	132
PID 4988 wrote to memory of 3144	4988	colorcpl.exe	133
PID 4988 wrote to memory of 3144	4988	colorcpl.exe	133
PID 4988 wrote to memory of 3144	4988	colorcpl.exe	133
PID 4988 wrote to memory of 4260	4988	colorcpl.exe	134
PID 4988 wrote to memory of 4260	4988	colorcpl.exe	134
PID 4988 wrote to memory of 4260	4988	colorcpl.exe	134
PID 4988 wrote to memory of 4260	4988	colorcpl.exe	134
PID 4988 wrote to memory of 2612	4988	colorcpl.exe	143
PID 4988 wrote to memory of 2612	4988	colorcpl.exe	143
PID 4988 wrote to memory of 2612	4988	colorcpl.exe	143
PID 4988 wrote to memory of 2612	4988	colorcpl.exe	143
PID 4988 wrote to memory of 4896	4988	colorcpl.exe	144
PID 4988 wrote to memory of 4896	4988	colorcpl.exe	144
PID 4988 wrote to memory of 4896	4988	colorcpl.exe	144
PID 4988 wrote to memory of 4896	4988	colorcpl.exe	144
PID 4988 wrote to memory of 1780	4988	colorcpl.exe	145
PID 4988 wrote to memory of 1780	4988	colorcpl.exe	145
PID 4988 wrote to memory of 1780	4988	colorcpl.exe	145
PID 4988 wrote to memory of 1780	4988	colorcpl.exe	145

C:\Users\Admin\AppData\Local\Temp\Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe
"C:\Users\Admin\AppData\Local\Temp\Drawing_UAE0225QNA01700-2025_AlRakhaGroup.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZhpymxciF.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\\Zhpymxci78.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /C /Y C:\\Windows\\System32\\rundll32.exe C:\\Users\\Public\\ndpha.pif
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Users\Public\ndpha.pif
    C:\\Users\\Public\\ndpha.pif zipfldr.dll,RouteTheCall C:\Windows \SysWOW64\svchost.pif
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows \SysWOW64\svchost.pif
      "C:\Windows \SysWOW64\svchost.pif"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\NEO.cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4480
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.pif
        6⤵
        
        PID:3912
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\sc.exe C:\\Users\\Public\\Upha.pif
        6⤵
        
        PID:3928
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\aken.pif
        6⤵
        
        PID:324
      - C:\Users\Public\alpha.pif
        
        C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\aken.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Users\Public\aken.pif
        
        C:\\Users\\Public\\aken.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
- C:\Windows\SysWOW64\colorcpl.exe
  C:\Windows\System32\colorcpl.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\xrdzexzabfkgungm"
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\xrdzexzabfkgungm"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4488
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ilrsfqkcxnctwtuqrnl"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\kgwkgiuvlvuyhzquiyfpnon"
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\kgwkgiuvlvuyhzquiyfpnon"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\deivoeicxpunvtzuwlapz"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2612
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\fgngpxtwlxmrxzoyfwnicrun"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4896
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\pbsyhpdxzgewhgkcxgaknepelpnw"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1780

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTk4MTQwN0QtNUUzMi00NjBFLUI1Q0ItMUVFNUE2REYzNkY3fSIgdXNlcmlkPSJ7NkRBRENGQTctQTIyQy00M0I2LTkzNEEtMzg0RkFGQjUyNTBFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDE5QkEwMkEtQkM5MC00RDg3LUIzOEEtRUQxQTcyMjA3MDAxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTQxMjA0Nzc3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vq2it5wv.h3y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\xrdzexzabfkgungm

Filesize
4KB

MD5
2a88aefa59b8c5d89bf69741a9072920

SHA1
5f6800f7454fd83aa371b12f206bce4f896936b0

SHA256
c24a083af8f7ff8e302bf58047df487edb010a68f9df7472965eaca6c79f9b41

SHA512
e4e676d14e67a3c347e1de662e089630717b4a486d2c8a656e20c4c3671e514c617a6b8ef890df8dea9fab0010e3a5225232e9147280d7e17a4a0a3efe23aa36

Download Submit
C:\Users\Public\Libraries\NEO.cmd

Filesize
28KB

MD5
d9b276c49813262ba64f91b640235ba9

SHA1
aec725ff0f08798f9fc4248db95461b96f75dd15

SHA256
67bb0e1739291769728fe9e8a77f6e8f5cf506ccf617d55a3349b0a7542d49a5

SHA512
95b3079a55ca05fd92b92985ade1ba955323752930766d6fb968e6981125dcac4b9a65f93dde17319980dd88c03540ceeb2faf66890d2e8f9358f25387058ee4

Download Submit
C:\Users\Public\Libraries\Zhpymxci78.cmd

Filesize
18KB

MD5
d202469089fa5ec9032f44408562f842

SHA1
bb493815fa079fd19529c25fd0964bc0ae0af26e

SHA256
9c330f29b95689d3ab2f7a461479cd87869464cc03e53b0d8ff5727baa8da979

SHA512
35788359b8092be103fce441fdb3a306d6697f16d752dd1300b1be65cd774f20bc24fd633c276d91d231c0295e57ab7f36aa9ff340a81c0b105681bc7a906ad5

Download Submit
C:\Users\Public\ZhpymxciF.cmd

Filesize
13KB

MD5
616f542f94791979d27798e12fe9374b

SHA1
a1d2b9c37d76e14fc3e8424644012c32754e8338

SHA256
d3c9ddaa8debfa28bfdff1dfc8c5ba4e11e39c7d9029ead83c874fcfc8325ddb

SHA512
431c38a99970f6e808966c333a345776537fa85ee1c427b9a4d72333542b30461955e93527c1d7771444d738ded79116d84cc0623638182f2de8f4a07593a1cf

Download Submit
C:\Users\Public\aken.pif

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Public\alpha.pif

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\ndpha.pif

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Windows \SysWOW64\NETUTILS.dll

Filesize
111KB

MD5
b124b37740d85c220735af1820b8dbaa

SHA1
cb11862a0ed2cde7459402256d6efb73d709e6fd

SHA256
da2b7b6cb51fff82cf18dc102e248ec90dde31c916cfa3c2b54563583c04d0c7

SHA512
3beec303bfd6f9090d2a4868c109830db919926bcb5e2def5bdfe01b7260d59247db41ff7a1bbe5be8294def1efe6feda2591fe45e67a1ae5bd4b47bb1a24d3d

Download Submit
C:\Windows \SysWOW64\svchost.pif

Filesize
94KB

MD5
869640d0a3f838694ab4dfea9e2f544d

SHA1
bdc42b280446ba53624ff23f314aadb861566832

SHA256
0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

SHA512
6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

Download Submit
memory/736-59-0x000001CDA2130000-0x000001CDA2152000-memory.dmp

Filesize
136KB

Download
memory/2524-81-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2524-77-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2524-80-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3412-5-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/3412-6-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3412-2-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/3412-1-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/3412-0-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3744-34-0x00000000613C0000-0x00000000613E3000-memory.dmp

Filesize
140KB

Download
memory/4260-87-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4260-86-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4260-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4488-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4488-79-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4488-76-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4988-95-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-97-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-70-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-68-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-75-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-74-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-67-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-65-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-89-0x0000000024E90000-0x0000000024EA9000-memory.dmp

Filesize
100KB

Download
memory/4988-94-0x0000000024E90000-0x0000000024EA9000-memory.dmp

Filesize
100KB

Download
memory/4988-93-0x0000000024E90000-0x0000000024EA9000-memory.dmp

Filesize
100KB

Download
memory/4988-71-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-96-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-69-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-98-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-99-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-100-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-101-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-102-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-103-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-104-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-105-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-106-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-107-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-109-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-111-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-110-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download
memory/4988-126-0x0000000001200000-0x0000000002200000-memory.dmp

Filesize
16.0MB

Download