blackshades | 35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2025, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe
Size

520KB
MD5

0ef061308ce5237b1c4feb5ec4895e90
SHA1

e8a728ead1cc3c2d931c6fc21ccd89fba5f0f220
SHA256

35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6
SHA512

79f5484feb40243edf020b3db170034a234e630634eba84f65828bb52d3722fa16de1ef7c0ab43ec21d5471f28525de9fdf23e61a61e6c92bf6f6d3847646760
SSDEEP

12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXy:zW6ncoyqOp6IsTl/mXy

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 14 IoCs

resource	yara_rule
behavioral2/memory/2604-382-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-380-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-387-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-388-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-390-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-391-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-392-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-394-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-395-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-396-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-398-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-399-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-400-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral2/memory/2604-401-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IESYQHRKJLYBYGU\\service.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\service.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	service.exe

Executes dropped EXE 15 IoCs

pid	Process
1284	service.exe
5008	service.exe
972	service.exe
4832	service.exe
1692	service.exe
1184	service.exe
4852	service.exe
3056	service.exe
1432	service.exe
3440	service.exe
5040	service.exe
4256	service.exe
4772	service.exe
3156	service.exe
2604	service.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TFOFXOLGWPAQAPQ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IESYQHRKJLYBYGU\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RQEFABWREMGLYIT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FNFWOKFAPQNWIOT\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MBVRMAWHXCGWXUD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BPLXOYRQSEINAMU\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FUUHJECEUIPKOLX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AJXTBWXLQVCDAIB\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KXGGSYPNRMTIJBI = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PIYHPDDEEAVQDKF\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CRQEFABWRELGLYI = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UXMGFMVLQIQEPFB\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCDOULJNIQEFYWF = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MEUDLAVARMGBGVW\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JXENWUFBMFGWPST = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WQIOVGHAUBROYOK\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MQEIDBSXQGGIDBK = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KNDVTCWLCHQHFQO\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\URPTOWKLDLLUPYP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TNGMTEESXPXLWMI\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IYQEOEAXVNDQMKP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QJYIQEDFAFAVQEL\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ACFQSNLODRYHTXI = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BJBSKGBVLMJREKP\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HXYVEEPWMKOJRFG = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NGVFNBABWCSNBIC\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVSRVIMIGWULLN = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JMYYCUSBVKYAGPG\\service.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 2604	3156	service.exe	143

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4964	reg.exe
1316	reg.exe
3480	reg.exe
2792	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	2604	service.exe
Token: SeCreateTokenPrivilege	2604	service.exe
Token: SeAssignPrimaryTokenPrivilege	2604	service.exe
Token: SeLockMemoryPrivilege	2604	service.exe
Token: SeIncreaseQuotaPrivilege	2604	service.exe
Token: SeMachineAccountPrivilege	2604	service.exe
Token: SeTcbPrivilege	2604	service.exe
Token: SeSecurityPrivilege	2604	service.exe
Token: SeTakeOwnershipPrivilege	2604	service.exe
Token: SeLoadDriverPrivilege	2604	service.exe
Token: SeSystemProfilePrivilege	2604	service.exe
Token: SeSystemtimePrivilege	2604	service.exe
Token: SeProfSingleProcessPrivilege	2604	service.exe
Token: SeIncBasePriorityPrivilege	2604	service.exe
Token: SeCreatePagefilePrivilege	2604	service.exe
Token: SeCreatePermanentPrivilege	2604	service.exe
Token: SeBackupPrivilege	2604	service.exe
Token: SeRestorePrivilege	2604	service.exe
Token: SeShutdownPrivilege	2604	service.exe
Token: SeDebugPrivilege	2604	service.exe
Token: SeAuditPrivilege	2604	service.exe
Token: SeSystemEnvironmentPrivilege	2604	service.exe
Token: SeChangeNotifyPrivilege	2604	service.exe
Token: SeRemoteShutdownPrivilege	2604	service.exe
Token: SeUndockPrivilege	2604	service.exe
Token: SeSyncAgentPrivilege	2604	service.exe
Token: SeEnableDelegationPrivilege	2604	service.exe
Token: SeManageVolumePrivilege	2604	service.exe
Token: SeImpersonatePrivilege	2604	service.exe
Token: SeCreateGlobalPrivilege	2604	service.exe
Token: 31	2604	service.exe
Token: 32	2604	service.exe
Token: 33	2604	service.exe
Token: 34	2604	service.exe
Token: 35	2604	service.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe
1284	service.exe
5008	service.exe
972	service.exe
4832	service.exe
1692	service.exe
1184	service.exe
4852	service.exe
3056	service.exe
1432	service.exe
3440	service.exe
5040	service.exe
4256	service.exe
4772	service.exe
3156	service.exe
2604	service.exe
2604	service.exe
2604	service.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4908	4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe	87
PID 4024 wrote to memory of 4908	4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe	87
PID 4024 wrote to memory of 4908	4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe	87
PID 4908 wrote to memory of 3112	4908	cmd.exe	89
PID 4908 wrote to memory of 3112	4908	cmd.exe	89
PID 4908 wrote to memory of 3112	4908	cmd.exe	89
PID 4024 wrote to memory of 1284	4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe	90
PID 4024 wrote to memory of 1284	4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe	90
PID 4024 wrote to memory of 1284	4024	35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe	90
PID 1284 wrote to memory of 220	1284	service.exe	91
PID 1284 wrote to memory of 220	1284	service.exe	91
PID 1284 wrote to memory of 220	1284	service.exe	91
PID 220 wrote to memory of 4616	220	cmd.exe	93
PID 220 wrote to memory of 4616	220	cmd.exe	93
PID 220 wrote to memory of 4616	220	cmd.exe	93
PID 1284 wrote to memory of 5008	1284	service.exe	94
PID 1284 wrote to memory of 5008	1284	service.exe	94
PID 1284 wrote to memory of 5008	1284	service.exe	94
PID 5008 wrote to memory of 3128	5008	service.exe	95
PID 5008 wrote to memory of 3128	5008	service.exe	95
PID 5008 wrote to memory of 3128	5008	service.exe	95
PID 3128 wrote to memory of 2568	3128	cmd.exe	97
PID 3128 wrote to memory of 2568	3128	cmd.exe	97
PID 3128 wrote to memory of 2568	3128	cmd.exe	97
PID 5008 wrote to memory of 972	5008	service.exe	98
PID 5008 wrote to memory of 972	5008	service.exe	98
PID 5008 wrote to memory of 972	5008	service.exe	98
PID 972 wrote to memory of 3732	972	service.exe	99
PID 972 wrote to memory of 3732	972	service.exe	99
PID 972 wrote to memory of 3732	972	service.exe	99
PID 3732 wrote to memory of 640	3732	cmd.exe	101
PID 3732 wrote to memory of 640	3732	cmd.exe	101
PID 3732 wrote to memory of 640	3732	cmd.exe	101
PID 972 wrote to memory of 4832	972	service.exe	102
PID 972 wrote to memory of 4832	972	service.exe	102
PID 972 wrote to memory of 4832	972	service.exe	102
PID 4832 wrote to memory of 4424	4832	service.exe	103
PID 4832 wrote to memory of 4424	4832	service.exe	103
PID 4832 wrote to memory of 4424	4832	service.exe	103
PID 4424 wrote to memory of 3168	4424	cmd.exe	105
PID 4424 wrote to memory of 3168	4424	cmd.exe	105
PID 4424 wrote to memory of 3168	4424	cmd.exe	105
PID 4832 wrote to memory of 1692	4832	service.exe	106
PID 4832 wrote to memory of 1692	4832	service.exe	106
PID 4832 wrote to memory of 1692	4832	service.exe	106
PID 1692 wrote to memory of 1520	1692	service.exe	107
PID 1692 wrote to memory of 1520	1692	service.exe	107
PID 1692 wrote to memory of 1520	1692	service.exe	107
PID 1520 wrote to memory of 1888	1520	cmd.exe	109
PID 1520 wrote to memory of 1888	1520	cmd.exe	109
PID 1520 wrote to memory of 1888	1520	cmd.exe	109
PID 1692 wrote to memory of 1184	1692	service.exe	110
PID 1692 wrote to memory of 1184	1692	service.exe	110
PID 1692 wrote to memory of 1184	1692	service.exe	110
PID 1184 wrote to memory of 2604	1184	service.exe	111
PID 1184 wrote to memory of 2604	1184	service.exe	111
PID 1184 wrote to memory of 2604	1184	service.exe	111
PID 2604 wrote to memory of 3688	2604	cmd.exe	113
PID 2604 wrote to memory of 3688	2604	cmd.exe	113
PID 2604 wrote to memory of 3688	2604	cmd.exe	113
PID 1184 wrote to memory of 4852	1184	service.exe	114
PID 1184 wrote to memory of 4852	1184	service.exe	114
PID 1184 wrote to memory of 4852	1184	service.exe	114
PID 4852 wrote to memory of 5060	4852	service.exe	115

C:\Users\Admin\AppData\Local\Temp\35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe
"C:\Users\Admin\AppData\Local\Temp\35ba852d6ec8277f1ba478107cdb88eddf97aaa9ef9fc7663dabfc38c930b8e6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempQOSNV.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RQEFABWREMGLYIT" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNWIOT\service.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3112
- C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNWIOT\service.exe
  "C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNWIOT\service.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempPVLJN.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MBVRMAWHXCGWXUD" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4616
- - C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe
    "C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempENYAW.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "URPTOWKLDLLUPYP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TNGMTEESXPXLWMI\service.exe" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\TNGMTEESXPXLWMI\service.exe
      "C:\Users\Admin\AppData\Local\Temp\TNGMTEESXPXLWMI\service.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempCPRMF.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IYQEOEAXVNDQMKP" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe" /f
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4832
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTRVQY.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FUUHJECEUIPKOLX" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe" /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempJRNWN.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KXGGSYPNRMTIJBI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe" /f
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempUFEIW.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ACFQSNLODRYHTXI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe" /f
        9⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempTQOSN.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CRQEFABWRELGLYI" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe" /f
        10⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempFYOJS.bat" "
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TCDOULJNIQEFYWF" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe" /f
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYFGDM.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JXENWUFBMFGWPST" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe" /f
        12⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempXGGPL.bat" "
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HXYVEEPWMKOJRFG" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe" /f
        13⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempIBEFO.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "KAVSRVIMIGWULLN" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe" /f
        14⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempYGUTF.bat" "
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MQEIDBSXQGGIDBK" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe" /f
        15⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempNWIOT.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TFOFXOLGWPAQAPQ" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe" /f
        16⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe
        
        C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        18⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe:*:Enabled:Windows Messanger" /f
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe:*:Enabled:Windows Messanger" /f
        18⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        18⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\service.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\service.exe:*:Enabled:Windows Messanger" /f
        18⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TempCPRMF.txt

Filesize
163B

MD5
c39bc0d04600b23543c168ab5e493954

SHA1
90d5fd1968bd4a36d533e1a33df65f0d974d3875

SHA256
a84d6ed78bba9e913ba15f198aa9c3408dab195d36d79185d212038f27264218

SHA512
b7eea376127c82dccc97b1b10653ff567f5a6e4523865bd06edb5059b05be00a42da95d8089748e5d6e230baed46cdc10d1dbc891af31ae3d3d2b2c0c7f17dd1

Download Submit
C:\Users\Admin\AppData\Local\TempENYAW.txt

Filesize
163B

MD5
f4f1eb33c618809fcc1a5e7efd3ee647

SHA1
7555e3e3d1ed1644baeea31bc2606914149b7558

SHA256
974fd4a357e27412e97677938a520a00d64fb2841c59ebf7bb5fb0589a0833b8

SHA512
0bd2cbcaf16f5f9f6d79981f50fad1192c50eef8be047afe3d692c959e1c7161e972fb48286c23b741650ff1912016e39dd36c7d9ae93ed3b5dc8452a0bb906b

Download Submit
C:\Users\Admin\AppData\Local\TempFYOJS.txt

Filesize
163B

MD5
fea3c7b3ae3cabaaf93ad02ba3fd3d93

SHA1
5056b9c08d9ced49a83b56b6cbf839ff890d2bd6

SHA256
c1891b16a57528b5c2379900dac7f471a2d8e59285cb6a81dfdba776124fddb5

SHA512
4bd117741577e9370597f06bc0e8dc2f25d609cd85a3a5b4ee6c6e7f13fdd3d260a8a05792a8f3acb821656c167366e48ba6bcd6ded8aaa3cd6718659a6a7fff

Download Submit
C:\Users\Admin\AppData\Local\TempIBEFO.txt

Filesize
163B

MD5
72b4575a7e487b928a7720741c22ad4f

SHA1
ab913f3839d4f22ee33d62a0c00e0dfb1d456d05

SHA256
f38a9e1a3288e171ae8ccc9cf9fea9fb81bd4c6509fbd789d58f349209176d2a

SHA512
f582ee3a512f26844187ce371af9d197b8c561e7812cf543c35e8ea420c318a33f0cbd15c2b35da0235e56a6d62b63f2680225e460ab7e20e057a44337bea6f3

Download Submit
C:\Users\Admin\AppData\Local\TempJRNWN.txt

Filesize
163B

MD5
2d380cc3f146925fe44172c92e910e8d

SHA1
b1d5e5101f8cefe9172abf49268d8fd88b97f14f

SHA256
5666808151f654bad0d5af7dfb6f63834031767bb0b58df3e40ad50acda00e09

SHA512
81192ebba1983d6a9174040f6e8ad0f3412a78d4836c016a1840d273ca0b48dcc64e4b74b9efd6251c7ce18b4347fa87df56f9e9e9894ce0fdd6fb7dd845b5e2

Download Submit
C:\Users\Admin\AppData\Local\TempNWIOT.txt

Filesize
163B

MD5
80375619bac59e9bd5393853d6684257

SHA1
ac34026c601191e680b9e86b11e15f4d727edf52

SHA256
6d6305816bdf8869557c5b5f3dc4aa633ddb6bc82bb12dce45ca606b547b2f89

SHA512
a72507aa375f4231759f1f56bb83c6fc88325c7538087059669b96add3be309c31d9a3b4aaa417f1ed152248e72564096faf525224698bc7edef82c1daf0dd48

Download Submit
C:\Users\Admin\AppData\Local\TempPVLJN.txt

Filesize
163B

MD5
577f5996f783f890ba33c6040c10977c

SHA1
d1915aefdd08072f2e106d8b9542286c8a5fa759

SHA256
d08343b6b8202d4a4277e3a76d5aa1eccaf3280293107211fcd647cfc318679f

SHA512
a60567082ad8f9ba8e96752f664c270dac82056d1fc05720b3b9854994b19a1d2b2ac47a707140799a24ba08acd1f4e096821228f167c29855b111df26e4db1e

Download Submit
C:\Users\Admin\AppData\Local\TempQOSNV.txt

Filesize
163B

MD5
3d1d4cc9ac30133d38400ce48f853715

SHA1
2761e55d0326738fd3c9acf1211942cb24f94095

SHA256
71638fb1743e447142677089779d8945573e8e2e8b5eedd779047568158fa390

SHA512
fcb33344037ec7b1005d0a87f9f198a15b64707b9977b12ef295e1c30a5e07157fd9ddfa4fb341b30db8eb91c53b9dfa195be0e0fb9414be64b683f24b6bcfce

Download Submit
C:\Users\Admin\AppData\Local\TempTQOSN.txt

Filesize
163B

MD5
2d778d21e9529cae1b0ef11236939a9f

SHA1
874b84a286703d6d55c7fda23e7c332a83d35708

SHA256
af57e6e302018e7881a8dab372695443a67bf24904bf09043c1d7f6df2c9a21f

SHA512
f7ead2790c88a47965b49eca28709717070bae22fd2759a4b1fffe4babe883eb2d9748c0c7e26cf099018a9125c9e10f399fbd63263d5d0012027a68628fb548

Download Submit
C:\Users\Admin\AppData\Local\TempTRVQY.txt

Filesize
163B

MD5
cc2281b5290761dd2186c3350cc6f4a4

SHA1
17624a63b7d755f01bbbfe2898ad67b1d2a1a24f

SHA256
f03902729551f314f17f2ebd714aa5f186553d3c0f666017dbebd151cd4fc2c5

SHA512
444e26b2253d5bfe51b3d12faab6d56ab5fbcad19333b9a5c6e0ab645af918df3f789a32816ee438bebba76357c0df4dfb969d7f9fa9adcac29c49307f1991b2

Download Submit
C:\Users\Admin\AppData\Local\TempUFEIW.txt

Filesize
163B

MD5
1f5b0a440773b1dbb89d3187b7e32108

SHA1
2bd09f5cb3ab6a3beb077b4848607654414f011b

SHA256
ec4fa25a78ce38848c382b67057b80ab4e045d3704bfd33b4973a8203b147336

SHA512
86dea559c5744a01dcb7744151f57c5fc11cb42ff0ec3c203518abb470d7101bfd7e4bd6f689721367069b4ba29f488c632539d3c1f5caeb043e993430241c3f

Download Submit
C:\Users\Admin\AppData\Local\TempXGGPL.txt

Filesize
163B

MD5
89513005f9143b990d479cac195289c5

SHA1
e07a5766d9d51b746317a52f3fc033dbf64604b2

SHA256
8f58e225a0302a9795f77a7db14e811edf7ce1b2cb6ef3682d0996532ab03307

SHA512
3c0533cb70f027f7373999cd71e6e708f8519bfa9d13e303acae6c921270933a4ba16fa32994ba7f54875324ee1aaad8e67c123e52c783d5a97ebe0b5fb849b3

Download Submit
C:\Users\Admin\AppData\Local\TempYFGDM.txt

Filesize
163B

MD5
e6e6da5ea023ba4c6496bbb070a9c7ee

SHA1
37130ee4905b289db4c1f553b07bb77150dd3297

SHA256
5087cf2626fb2a96482b0464e09e5a779cf355263109ec1fe4c8c963be2635ea

SHA512
017a188e466c677b3ceb39f59a73f35ad690f0ed8a65e268f90b6d62bb05d062aa7a4dd4e24abc1d490a4650473c09e678a09e968f658b587c725d53e00bb482

Download Submit
C:\Users\Admin\AppData\Local\TempYGUTF.txt

Filesize
163B

MD5
e65cb9e897fc570d7094a3666ff08b69

SHA1
6d96f008bbd2008094276acd382d00262e8817a9

SHA256
53df98660cfff8f32a7535b54600cc34463616c4aac3cb4b7c53b403c5395c8d

SHA512
ae43186fe4b4ab8338a4943d973b2b74f8e8d080ed39ff6479035ff3882dabb32d7510ef9f5291d02047ff68344ea5f7a8a2194230f5818e2a5632199727b73d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AJXTBWXLQVCDAIB\service.exe

Filesize
520KB

MD5
70d64863b06154b39a108f9fbe7543af

SHA1
663a50de48afd491f0e2e1c7e53eb421049437d3

SHA256
99bca21d3ef5746aead4362fff32c7778b44016d173d1ba76e2f7b5d41427074

SHA512
961cafd10bce7f97497b380ea66d0970c937dc9efa12c472f6d3bdb281313aefa06e277ba4b6acdfd5fca55b21a61e6c43e06c2863868b8aab1624cdff912c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\BJBSKGBVLMJREKP\service.exe

Filesize
520KB

MD5
8d7c9c9d8a21f45a03015dea0581313d

SHA1
76e94d59882c16a453b00cbd96eacdc9df2fc7c6

SHA256
9968f0e1a41e2bc903b0fa1e738be4fd4a7b45d8a82f81968966d76327473e91

SHA512
48c0cff28929f269a28b2eaa9157f64e48e58c8f74cb993750f568c19616e91d3cdf3e667124048997d7f58c0a8c9d20afc6855ba8a6b8c41b0a24bd49321f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\BPLXOYRQSEINAMU\service.exe

Filesize
520KB

MD5
b4fc05aa924f1555b4f718c218490043

SHA1
759e00aad17d3362fd8baa75284e974f5e388dcd

SHA256
55f1931d874cb4bf56396bb4f116e67be644c2835560b0a66b882fa25fd58884

SHA512
13a93fa8175add6685d1c198e9b299a2a6547cbc0aeba3fdcf3ab82cfd5e2ae6f9271a3f63873e95c0b74808013f8c083e068d5731b919425a599790d55553ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\FNFWOKFAPQNWIOT\service.txt

Filesize
520KB

MD5
be6675220d2463bab5e6113cb9675360

SHA1
834ba1d38f0c5942cf559f2a0134247c8b660f0b

SHA256
361d2cbfeb6a72f96de13379215650f7c4ef2d90b9f9199d955d924a276784e4

SHA512
0d0b623c2bdd592940c780f3599c635c04bb94aed81c88a7228db993832662454df76e76b71d300211aaba556c6867932dfbc0f7cfa90c81b021aff8b33e25d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IESYQHRKJLYBYGU\service.exe

Filesize
520KB

MD5
1600ffe587376e62c10298b8ff339681

SHA1
9b257afb5d6c3bc22fb709a0c6096c9aa3be5e33

SHA256
86240765a74df36c712448a09515ba4935a79d84c8852907960f8ccb1d8c1867

SHA512
2d7c20431104db8abd27ab757e10619efc13fea300dc5a335b668fd5db91798b46f4758ebb81dc5bb7c1737c4c3c2bb74aa5df0fd910adf0f5e0fa79ef8df8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\JMYYCUSBVKYAGPG\service.exe

Filesize
520KB

MD5
3b55c16776a41a047115b24374d319fd

SHA1
0c4fb627dc31c1b2005ca2fec9831fb5f33c4507

SHA256
6c3552ff1bd29c259e27a36ea1bbb83d6e513ffaadbfe511918cf05dce06e0f7

SHA512
1e853220ab488f1e407453b8b5558deeaba6414667fecc0315446cdf46c32ae5e02c1c7ab2483a7c6b34e73749a340e533a77c955932caabf14b987b89145797

Download Submit
C:\Users\Admin\AppData\Local\Temp\KNDVTCWLCHQHFQO\service.exe

Filesize
520KB

MD5
c6b0ab7f38a55fd1bb0faca8a51faaaa

SHA1
29aad5301e5061251fdaa0ac8915fa461429d252

SHA256
a26d0b206cab0445cdebd067adf4a65e962c4d6bc4b6d226e7e729310468d018

SHA512
89c1981c79dd5669b59a9f297adc27a2564887df1f67623f6d6e836c3e13da0a479d8ff2c4939bfb596bb4a28d52e999afab45f04eedb0fda449038baf3dadff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEUDLAVARMGBGVW\service.exe

Filesize
520KB

MD5
15e4593b1bc1c9f4c03a317d0eac655c

SHA1
37545f2340876b5a7d2813664fc4ac98cbde1675

SHA256
3a8a76b03637b48d3c66d540e401485717de06d27000855c0e2b6832aab4b2d1

SHA512
4a2e882d0ecdb0283e8c30954310517fe882d73d400c20f9d4e32baf3462910214555cedae354b6c807032d614f5746bf875f81898faa3b158d3eeba1c2a2ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\NGVFNBABWCSNBIC\service.exe

Filesize
520KB

MD5
3fb337747a520e6d171e4debf9cdd668

SHA1
e4615d8f6555c849e157bebf7557746f70a1cd04

SHA256
fe9b260f5a4e714a19b0c741550a0f1e363780d5bf4a46d19747686308a811a0

SHA512
a589bf13412e9f43f80012917db5b3682d763f893d5830c50154edae352c0e718a8457706fff4cda9080b71e4bb227024d8879f730b91fbf60e1f058fa6ea86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PIYHPDDEEAVQDKF\service.exe

Filesize
520KB

MD5
eab890278c681f557845efb0f78ee70f

SHA1
a9d57329916c3bcc5fa5f8055faaeea4eea8ced4

SHA256
c32346487218149bb112c6e60c5fc5ad6d1bf28ae8f285af54b3a32a07113260

SHA512
b0ceddbf7d57d7f99dcf6b96a17639bba58c5b799cdc44d1590cadeb6931da7ba9c08d7926cc149a2d02b4aecd436dc1141f58cbf265b042a5913798ad502752

Download Submit
C:\Users\Admin\AppData\Local\Temp\QJYIQEDFAFAVQEL\service.exe

Filesize
520KB

MD5
e3be5cd48bae3705db82b9b2cf45529a

SHA1
0659c2991686d0934ad1384fb6873c45330199e4

SHA256
8e1ed9f3f6e1362bfc2c3677255933923bada3c7665b77537873c41559fa6793

SHA512
6d89aa9e59ac54c9bea05d80f87964fb34702e261f4f228ea5e223a21905b3a66bb12ae9a84697d2546906d88ca36a8a85647ca95e404448598fefa064597cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TNGMTEESXPXLWMI\service.exe

Filesize
520KB

MD5
c31a447fbb37522e259a0b183f827fba

SHA1
5528f12e49e258abd7f7f4c3e09199732d4b9117

SHA256
f49a992974c308d619efc70a8c1ee3cad3a72c4ef41b64643bdb6ed421c799ea

SHA512
a137ec5a28c6b34062fa0dd4a1fd16a99f2eedb7adcfc6c945d6261ba7136a373643449d4dff21b77b875057a6f180983fd0be20581debe5863ba09a0ee74446

Download Submit
C:\Users\Admin\AppData\Local\Temp\UXMGFMVLQIQEPFB\service.exe

Filesize
520KB

MD5
1c83d86b90032d468781f4cbbd01d423

SHA1
7058b802f0afc1678426551b4edc247f5f411509

SHA256
a4b5ec1e3690660b11a1feb6d2f361291e2cff72c123d6b51f26a8ac036f8716

SHA512
1d4e2d4821a636c0b1e9da98af5de2fa22f148a59603dccff0487cb5b2215291f0a1431aa98e831a043aa784ec07e2a903bd30e1eccc154ec0c1d2937babf049

Download Submit
C:\Users\Admin\AppData\Local\Temp\WQIOVGHAUBROYOK\service.exe

Filesize
520KB

MD5
e4e8283f710123c27c0819f6146babea

SHA1
0f1940b8111db7fae400a8f2bc853db2e2329174

SHA256
0009e4c04a084eca6b7a5f87427d8e2808de5b5474795ee2423588b1c0497211

SHA512
5e43fdc83f3918c2d703ebd3dea80f56464bf3ef0d8c6826c2b493568127e2e6c9e75c34818455afa1b430b9c90f99fc6c537532b78355fdb68bfbecc434fcd1

Download Submit
memory/2604-382-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-380-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-387-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-388-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-390-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-391-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-392-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-394-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-395-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-396-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-398-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-399-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-400-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2604-401-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads