sality | d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

Resubmissions

11/03/2025, 00:00

250311-aaawtasr13 5

10/03/2025, 21:57

09/03/2025, 01:58

08/03/2025, 06:55

08/03/2025, 04:53

Analysis

max time kernel
0s
max time network
15s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
10/03/2025, 21:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

My-Skidded-malwares-main/Run All.bat
Size

45B
MD5

1d4de1822af1bb3991e6eb67a12a69b5
SHA1

41c9d68bf5ad00072b9e6b0c02e8a71fce2dbd52
SHA256

ca791170602f2254493246550438de14c3e7b61b72b8bd4079f70178a1aaa102
SHA512

c59dd96701d41b281e24e602aab78bc8db77070365dea78ca2e72bc8a772121dbd110f67410490d8d1bee1b25edbf05d3517c357868f471aa7b8c652cf0ade50

Score

10^/10

sality backdoor defense_evasion discovery execution upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2504	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral26/memory/4080-31-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe
behavioral26/memory/4080-234-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral26/memory/564-2-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-6-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-23-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-28-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-26-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-9-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-7-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-4-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-29-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/4080-31-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral26/memory/564-39-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-40-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-61-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/564-138-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/files/0x001900000002af57-194.dat	upx
behavioral26/files/0x001900000002af5e-287.dat	upx
behavioral26/memory/2756-293-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral26/files/0x001900000002af8c-504.dat	upx
behavioral26/memory/3120-515-0x0000000000400000-0x0000000000494000-memory.dmp	upx
behavioral26/memory/432-381-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral26/files/0x001900000002af73-377.dat	upx
behavioral26/memory/560-261-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral26/memory/564-217-0x0000000002300000-0x000000000338E000-memory.dmp	upx
behavioral26/memory/4080-234-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral26/memory/564-134-0x0000000002300000-0x000000000338E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6abdd72e82088f5aab90dc9e02f2d9781cea1b3f1c84b3f16df4810956f68ef2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnaRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chat_im_cooked.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4932	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1036	4936	cmd.exe	83
PID 4936 wrote to memory of 1036	4936	cmd.exe	83
PID 4936 wrote to memory of 1036	4936	cmd.exe	83
PID 4936 wrote to memory of 2332	4936	cmd.exe	84
PID 4936 wrote to memory of 2332	4936	cmd.exe	84
PID 4936 wrote to memory of 2332	4936	cmd.exe	84
PID 4936 wrote to memory of 3832	4936	cmd.exe	85
PID 4936 wrote to memory of 3832	4936	cmd.exe	85
PID 4936 wrote to memory of 3832	4936	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Run All.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\6abdd72e82088f5aab90dc9e02f2d9781cea1b3f1c84b3f16df4810956f68ef2.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\6abdd72e82088f5aab90dc9e02f2d9781cea1b3f1c84b3f16df4810956f68ef2.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Bahhhh.exe
    "C:\Users\Admin\AppData\Local\Temp\Bahhhh.exe"
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Berkelium.exe
    "C:\Users\Admin\AppData\Local\Temp\Berkelium.exe"
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Boron.exe
    "C:\Users\Admin\AppData\Local\Temp\Boron.exe"
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Californium.exe
    "C:\Users\Admin\AppData\Local\Temp\Californium.exe"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\CatDaMBR.exe
    "C:\Users\Admin\AppData\Local\Temp\CatDaMBR.exe"
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Cobalt.exe
    "C:\Users\Admin\AppData\Local\Temp\Cobalt.exe"
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Curium.exe
    "C:\Users\Admin\AppData\Local\Temp\Curium.exe"
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eee.bat" "
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Einsteinium.exe
    "C:\Users\Admin\AppData\Local\Temp\Einsteinium.exe"
    3⤵
    PID:992
- - C:\Users\Admin\AppData\Local\Temp\EternalOrange.exe
    "C:\Users\Admin\AppData\Local\Temp\EternalOrange.exe"
    3⤵
    PID:728
- - C:\Users\Admin\AppData\Local\Temp\Fermium.exe
    "C:\Users\Admin\AppData\Local\Temp\Fermium.exe"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\Flerovium.exe
    "C:\Users\Admin\AppData\Local\Temp\Flerovium.exe"
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Gallium.exe
    "C:\Users\Admin\AppData\Local\Temp\Gallium.exe"
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Germanium.exe
    "C:\Users\Admin\AppData\Local\Temp\Germanium.exe"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Hafnium.exe
    "C:\Users\Admin\AppData\Local\Temp\Hafnium.exe"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\haha.exe
    "C:\Users\Admin\AppData\Local\Temp\haha.exe"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Iodine.exe
    "C:\Users\Admin\AppData\Local\Temp\Iodine.exe"
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Lanthanum.exe
    "C:\Users\Admin\AppData\Local\Temp\Lanthanum.exe"
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Lutetium.exe
    "C:\Users\Admin\AppData\Local\Temp\Lutetium.exe"
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Nebula.exe
    "C:\Users\Admin\AppData\Local\Temp\Nebula.exe"
    3⤵
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Neodymium.exe
    "C:\Users\Admin\AppData\Local\Temp\Neodymium.exe"
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\nomore.exe
    "C:\Users\Admin\AppData\Local\Temp\nomore.exe"
    3⤵
    PID:4076
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\AnaRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\AnaRAT.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
    "C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe"
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe
    "C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\62264.exe
    "C:\Users\Admin\AppData\Local\62264.exe"
    3⤵
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
      4⤵
      PID:2948
- - C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
    "C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe"
    3⤵
    PID:1904
- - C:\Users\Admin\AppData\Local\1231234.exe
    "C:\Users\Admin\AppData\Local\1231234.exe"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
    "C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"
    3⤵
    PID:348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2504
- - C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
    "C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe
    "C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe
    "C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
    3⤵
    PID:2844
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\chat_im_cooked.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\chat_im_cooked.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3832
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Cirno.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Cirno.exe"
  2⤵
  PID:1088
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\CRINGE-DO-NOT-RUN.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\CRINGE-DO-NOT-RUN.exe"
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\DAMK.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\DAMK.exe"
  2⤵
  PID:900
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Discord Expliot Kit.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Discord Expliot Kit.exe"
  2⤵
  PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit
    3⤵
    PID:5076
  - - C:\Windows\system32\wusa.exe
      wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\
      4⤵
      PID:1748
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\driverupdate_report_windows_10_22h2.txt.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\driverupdate_report_windows_10_22h2.txt.exe"
  2⤵
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe"
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
    "C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe"
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe
    "C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe"
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
    "C:\Users\Admin\AppData\Local\Temp\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\cleansaturn.exe
    "C:\Users\Admin\AppData\Local\Temp\cleansaturn.exe"
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\error.exe
    "C:\Users\Admin\AppData\Local\Temp\error.exe"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\concos_1.6.exe
    "C:\Users\Admin\AppData\Local\Temp\concos_1.6.exe"
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\colorful screen darkener.exe
    "C:\Users\Admin\AppData\Local\Temp\colorful screen darkener.exe"
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\levislocker.exe
    "C:\Users\Admin\AppData\Local\Temp\levislocker.exe"
    3⤵
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\malecus.exe
    "C:\Users\Admin\AppData\Local\Temp\malecus.exe"
    3⤵
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\evil.exe
    "C:\Users\Admin\AppData\Local\Temp\evil.exe"
    3⤵
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\Solaris.exe
    "C:\Users\Admin\AppData\Local\Temp\Solaris.exe"
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\TEST.exe
    "C:\Users\Admin\AppData\Local\Temp\TEST.exe"
    3⤵
    PID:244
- - C:\Users\Admin\AppData\Local\Temp\ss.exe
    "C:\Users\Admin\AppData\Local\Temp\ss.exe"
    3⤵
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\YT_Bot.exe
    "C:\Users\Admin\AppData\Local\Temp\YT_Bot.exe"
    3⤵
    PID:1632
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fellos RAT-Pack.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fellos RAT-Pack.exe"
  2⤵
  PID:3964
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAawB2ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHAAcABxACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAWQBvAHUAIABhAGMAYwBpAGQAZQBuAHQAbAB5ACAAbwBwAGUAbgBlAGQAIABhACAAUgBBAFQALQBQAGEAYwBrAC4AIABTAGEAeQAgAGcAbwBvAGQAYgB5AGUAIAB0AG8AIAB5AG8AdQByACAAaQBuAGYAbwAgAGEAbgBkACAAUABDACEAIAA6AEQAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGoAZwByACMAPgA="
    3⤵
    PID:1592
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe"
  2⤵
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\gado.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\gado.exe"
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\gado.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4932
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\KonataMBR.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\KonataMBR.exe"
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\llrainbowalexll.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\llrainbowalexll.exe"
  2⤵
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaFumoDownload.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaFumoDownload.exe"
  2⤵
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaMBR.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaMBR.exe"
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210FACEREVEAL.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210FACEREVEAL.exe"
  2⤵
  PID:3572
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210KeyGen.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210KeyGen.exe"
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Megumin.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Megumin.exe"
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\NazrinMBR.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\NazrinMBR.exe"
  2⤵
  PID:4696
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe"
  2⤵
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker2.0_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker2.0_x64.exe"
  2⤵
  PID:4080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1d055 /state1:0x41c64e6d
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe

Filesize
446KB

MD5
385585748cd6feff767a913bd76c2457

SHA1
1bedac2bc0da78c4dbaaf3914816d84f5c08f005

SHA256
0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5

SHA512
80619ee207d6c5a352d811405c40bcb9043fb2b2759ad40575e03e9e7b89f4ad55f6bc01dfe62a64b42dcd9b3b5bfef10503ce72f4efa0d2e39546f92047a880

Download Submit
C:\Users\Admin\AppData\Local\1231234.exe

Filesize
37KB

MD5
8f00376c7ee9fb1653dc2ae09afa5589

SHA1
0005d278c062b496628e9c2a27043e87fc05689e

SHA256
6d2223ee967236cbc2c35809fce753553cfdb0aac7ba34e7087e19d61eecaa18

SHA512
2512a5b67867c7c1cfbc19f7adc7ad56c3a2bf821f0c74341d0e69ee89dc20bbdc9118714d67ada6a846edced58afc6d01b0fe7560f2166e02c9044f85bc00f9

Download Submit
C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe

Filesize
227KB

MD5
1a83a244d9e90a4865aac14bc0e27052

SHA1
d2b65e7aed7657c9915f90f03d46902087479753

SHA256
150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712

SHA512
f4b9d26d8a0841f9425abf038f85563ddee65e2404bc508fd23c8023bb565fd7f0ceaeaadde49c4951d3bbbb93f6b64b3cf610464855a2bf2d418477dd4fe03f

Download Submit
C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
C:\Users\Admin\AppData\Local\62264.exe

Filesize
198KB

MD5
f30e9ff8706f3ec72c82a74ee6328db9

SHA1
b526d52d22600b28892f898a717eb25779ef3044

SHA256
d22bf8ad4fc9b769ea2944bbdee78277ab29bac7199407baf7c3b489568a9489

SHA512
a21220d5f1818c9c5aa55cf8560365888046a090b8892a9d87919b48ac921bd2fdfd6016ace77fa8205fde067c7d45cb01032a47f4325fcac560361d66cc58f6

Download Submit
C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe

Filesize
1.6MB

MD5
e2100d88aca7c0a44ba9bb988ccd3916

SHA1
ddaf17adbc769556037bb4fbf4bce7065bf57ef3

SHA256
75f846b15fa1b548a0143f35584b25875a03c03a783e9310c8573f3b76957688

SHA512
5b7fb077ea9d7d1310db3eb26b6624e3d12fe9f3d55d0a37d57c28197dab7e05449c6611d5b9a02f054d8ad790e12050228c8d7b913bb55e3f2b0da694c67ec5

Download Submit
C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe

Filesize
608KB

MD5
690c1b65a6267d6d0b201ba46089aabc

SHA1
9eb6859bae82bcf8b9df7cf4fc061cd9155fdc39

SHA256
244f3a2fad1afa232909355901f33cca18ea95444c5d142c7aa308170db5294f

SHA512
cc540851386a3b98227822b2c952a57caf15db4563f9c246b8be5bca0989aaff70e64191d010738db86598d76dd8ad4e59a50965224db9f623edb64f2f8b3e2a

Download Submit
C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe

Filesize
110KB

MD5
0dcc21bdebe05957ca2922be486abe22

SHA1
8bcbd8a839a58e0050c17221e6a1cc775f07586b

SHA256
73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3

SHA512
0752ba22340fd3383132243580cb28a147e67b42bb920af8c0fde491d550556fdfa296e70d94f2ce9798faddd0dad4664e2c2edda8f6604b9ba9e63e8f875e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.cab

Filesize
49KB

MD5
8cfa6b4acd035a2651291a2a4623b1c7

SHA1
43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9

SHA256
6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9

SHA512
e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685

Download Submit
C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Filesize
568KB

MD5
4448a3c2ddfdda45009b440faa39a5fe

SHA1
b16a26331d6ebe8f4a45b43e8b0251a715139b10

SHA256
70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

SHA512
094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe

Filesize
65KB

MD5
694efccf0c905305f5c8418499fe335c

SHA1
1fa42976df8d8b1848ac2d99468da3c17785d285

SHA256
7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b

SHA512
294fecfb3abb91a9a61001b26acced7a1cc99abb0a140a8bc352b51794e3750b7579b44543d1afde676c0e75ddc6c80c44eb49b959946654bc5f88e0d2b49fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bahhhh.exe

Filesize
230KB

MD5
27095b6e72d783c7ad7114f91b87e640

SHA1
15ef79e042f4befb60783b1d7931bfd916972096

SHA256
0738c33d4cbdef4bd1c216248a0a7a20ee7254e63d526fc113e827938aff2520

SHA512
9852bc26220c0ca60921425f7a089c4b5356624be41cf1d0e5b04eb36f47b840e2e1235d115927a6d3d69c6f3e60dfef484c67c59ade9edbf4e407b2c02c02ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Berkelium.exe

Filesize
74KB

MD5
c9f5fcf8b057f6f5b0f562fe1181cb18

SHA1
a1a4b505e2fc4d92ebacbdc6c783a29f7553bc41

SHA256
ad024d92fa10cba15bc1930f6d6792eba33feead5b4b8c4b4881c34409c31e3d

SHA512
a3fbbe86632fccdc74c43bc7c0afcb7c33463540f21473099a2176edff870bd47eac98d2dc64f684939a60888db190a4e091cc7d3068ca436da8e62969b17e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boron.exe

Filesize
207KB

MD5
30f2f3ba2f5053f75fd1af6186db6f7f

SHA1
ac9f70dcdf0a4caf57ac8b300b2205090f0850d7

SHA256
d350d7c68aa5b939d08fba384d1fbe44b757fcdadecb6534b5239d46bfef1f75

SHA512
5c39807596324fd7ba12c326af2e9f9b8666e76980ad1189fc49b71736eae779e461e5da71f9a27e014be8a8bd978dac6e7b3b3ceddbadb85f95682cc46cf7d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Californium.exe

Filesize
223KB

MD5
306a2acc6e08033fad9b193dcbd4de05

SHA1
bccff10f633cac6c0bbda5a54061dd05d8f980de

SHA256
512a4972b15235864fc896484128b79d48d0dff076d6356559a0b75cb67067d3

SHA512
9d5e2abbd480181156624804d0709b403297261062bb3d3b2bd08f3a3905909109dfbd442268f94f2269ee3b8bf7a3a1f4206c65e2bd291602586f44fd084fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CatDaMBR.exe

Filesize
683KB

MD5
5cdd80274f50bbd149441b4563416341

SHA1
0436f39868fde8334f7f8398345fa97263a1f38e

SHA256
6d842aa210cfd67b6b217b7d5abb88b513e235d3a763ac9eb80733f8bbfd5814

SHA512
b6f1e546de2ac25b7fd48763bf19556d1c83f63e68a0886a3dbb9977886693688d35da6f13ee947c661aef67930af1223f898cdf3bf2fe79d989966568c95331

Download Submit
C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe

Filesize
1.8MB

MD5
55677d2f4f251b558660652002933369

SHA1
804357acd8e75f6a8db9b907a8df882e8588b6bd

SHA256
f714fb12a601649f1e0840a75265337c77683ec64a599f0631d2ba512bcee5f5

SHA512
12343e2ede7dc8534a4682a007ca67b34c287d4e1f7d3565d31860d72d643ad9923b59953571e95c404a9b2951e6bdd4e6e6584f246852f02f53bd832d0bc119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cobalt.exe

Filesize
193KB

MD5
62f60979fd6a1b5ac711801d575164bd

SHA1
08374033a9219287c568774c90e11e74d6862f43

SHA256
a165dade3174a456d5af6835359d090cfbde706b941c46177656e06e869409a0

SHA512
f855c40c0649d10ede6857f0fee888c724f480bdcbba24c60b5bbb0a86a3ab9fdd1872813ff574993a4d50cdafd7259b29499b4791ec11c6b635157e2b718e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Curium.exe

Filesize
45KB

MD5
09e2aac9365ada595f8421858745bb27

SHA1
5a06e5e910c5bff7dcc598207f8c38e998c34a1f

SHA256
95497d5ed96e5b3458e1729e6c5015cfab6c5bc44907f2324ac7c6bd014a9ba2

SHA512
7294b109b0e0934a1f2f3648b65c55c319027b154f3866e64fbf5480aff352e5424e511d9f68af29bdbccb897ad8e874b55f42be1d745dc56fd5d360c36005e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Einsteinium.exe

Filesize
59KB

MD5
0b18325551f9d0055a9e3aa7921dfc76

SHA1
3b5076541b73bb6f9b1910dcc339709e360a9a92

SHA256
350f39bf3a98520e20f6aed34b4786ee2f6518c979613653b08dcf07f3b5e15e

SHA512
b45440ca9863bbb1cf2e1434612b32ed2f4f8d54645a02e4c7dc84297fae2222a40cb18e6e29f0eba5e475846ff02fa60ce35107c63a6f0a07830d89647a285b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EternalOrange.exe

Filesize
272KB

MD5
59b1f2c4da85066cc5a73d80cfb9dcd2

SHA1
bf005c3de251295d74ec19bf90d03ddcf06b1d88

SHA256
9242ae324864a6388d09a076110b3d55cb97056e22b201c4cc8cbcae29f302cf

SHA512
951bd4db81e9f0bdbc6a16c9ce3f400f287e9815e097e0a984d407dc8df85fbde150930a18af474f86221a4a8f46413f8c08cf2df0bbd1ad47bb85b0583595fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fermium.exe

Filesize
55KB

MD5
21f63fa6e6db4240fde9121fb4847a7f

SHA1
a4c4ac1234960c7c3dbe0bd3133ec5c56deb3dec

SHA256
4bab7485b91ec5196a586a75ac7ee7d7cb8d7cdac96f59b8d5a53a1abe09910b

SHA512
cbba2dd355b6472284d0a50a2887f5de4b7c5c109eb3ff2f1b79fd6709b66c63ae0bd8146e9b1fcd97cf699144b8340b9a0ee4714aa9b15d248e63d1d4e2b9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flerovium.exe

Filesize
192KB

MD5
f728c4f178a7bc544136018d674f89a1

SHA1
14d60483112dbff186fe9c8b5f3efd644b7855e5

SHA256
bf3b53c82583803c36e00c1658cc7ea5154fa7015cc2cefd7d37bdc05a1824ac

SHA512
4544c1aaa98530cd815c76d0d3a25ca6c8e74c7153260b49dd5c0050bd2df7a5bda25219766e2fa8912293758039c54afddf0dfd99f5d8af4e50bf0445a7e8da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gallium.exe

Filesize
64KB

MD5
e8bf30b1b6173a24fe3c091f5e41e51e

SHA1
2bfb376d9931b551ea2aef92e516fa4247e36c2a

SHA256
e8f9473c5910d908bbcf8b3100fd1927fa4293a99b4684e29f213f44cc61a58d

SHA512
050c3779a393a78a712f66fb23fd3305ad992a81983e2c91c29a6799423520c876344936ed5ab0e027c237ab1921243e67cae4e83c425828807f9fd59289d7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Germanium.exe

Filesize
38KB

MD5
cce249ef793a056cbfb2de01ba299b49

SHA1
25e73e283a841b6f574754a3c296cfb3220616b1

SHA256
3a1dd67101f8bfca844bdeb06bf6c2b2a9e1cf6cae15a0087b8f3489cf4d7a87

SHA512
1431743e36e75c3699e90dc3889edae81bc43aa0a558cb5636d42b9c65b87df017bfc740a96a4a40d49d278dab21d1b3fd22178b5483114bbb586d0e0c020413

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hafnium.exe

Filesize
313KB

MD5
c8e330ae8170030eec31701a9a0973af

SHA1
a6334de48f112b958bfcfe80274f69a958276c14

SHA256
83f9eeb4e9c654dc1319f1b07d1ea6df6f0b30f16cf252d918f478f40987cba4

SHA512
f11fe29d8f1018787084f9153fc2c2167fc115f1e0da0ab162cfedec97dd96aa338d536affd7ab72e108b87e4bdb422067d4475ef484aeb9cc9a5f7e998e195a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE

Filesize
210KB

MD5
4ca15a71a92f90c56b53d9d03da17657

SHA1
3d610aee0423eea84ad9dc0df7865e1bed982327

SHA256
ab532f166e08886166c0ed6426bb6a8998de8273d37ccac5823528a1ba3d8ca1

SHA512
e0d9e11b9a0fb84bab21cbe4638ead80319a9b38ed810a59a612ab844331adec32f2499425b0d9269f2eb3714e497ad31c9bdfded1f829533cc77bf2dea6464f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iodine.exe

Filesize
169KB

MD5
be8145c68550808dc874c1cc9489339f

SHA1
ef17d69f633e31bc3bac3e9fb97656de4e548d34

SHA256
6dfda56a88cd9768bb50dc9c1da8846a09934933d0a6a603eb73aebd198084be

SHA512
8352e2e3045a77af70cd564d0b31dbee8c688d29834a44ed8c4e7fc44e4883cac03ce87f9634f4dadd41ccade13bd11913240c1bf208a4b7d22569513a28ad86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lanthanum.exe

Filesize
243KB

MD5
2fdeccbe48b901cf84759f83f14dbe70

SHA1
e8376f1b4b1fdf4858cd9024164517b4258a113d

SHA256
522574c09e88c2d39787d6a3927bc051cf7eeb69620953cc0735665eb15d1a44

SHA512
85f7468c6e56861d06548b160d5541896077230d9e77ea5c598c0f5c959b5dfa0c1c0214eba54700742999ab8083048d382b6052ff782d768e9b74acde94fd21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lutetium.exe

Filesize
250KB

MD5
73d444ef98ea3bafe5d5abc33cd87515

SHA1
f995876e720d9e6d5a5f13fa7e2b6822b6904d24

SHA256
fd7a0b8dc6f5d6053d1206cba9a7752fd7d10172b4e86b71a2fd88b991b86148

SHA512
43fa73090eaa0cb2bb8e99a6d987f56f7fdc7805ae36657e70bd948819a6b5aeba2e80c783c2334cf5afa21c2dd72a7e9882467a020509a5496cad2aeed37dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nebula.exe

Filesize
287KB

MD5
78091f56f0982281026b9fe997666e7f

SHA1
41ebbc8fcad44a6ca33a685aecb0b2bff4a35062

SHA256
ce1f154f417ba29a555744eabb2b7b9fc6aa2daaa763fa495541909d1fcba607

SHA512
a2246d395aaba5b476507ea2781ddbc34d47d1e4a5faf4e18e611e75b4f7f47412203969e7d3fba103e9b00cbac1f224f5aef9bcd4c6e1ada79c4a8f013e7714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Neodymium.exe

Filesize
208KB

MD5
ef425827a51e138cd3ad64886639e379

SHA1
4075b501dc45eb3a8be37418c2b5877f888eae3c

SHA256
68b258531dbc544b6d330b1f247af8cd47fa301326d1dfd714e889417224a864

SHA512
4d15353cc9881c20c0086d502aad1c67ab1ea6be779f6be8f4a99f7abf901624cf325f60eb1041b486a693bdacd2002399d059baff0d36c4850f3cfd18b1cd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solaris.exe

Filesize
47KB

MD5
05859c4616d5d3de2927122b4d5303b9

SHA1
7ebef99aedeb8a54fe3c70424282e462df954ef6

SHA256
af51004a01329780e0cf6c04a389de96163e61aa004833cff7d59abef2a053a6

SHA512
d73f6b8a9313a727931135107f800e8885d0e471aaccf1461928a50c6c2a4e2921a1ae6eff8a2a1755656af3cb380782a7e0744573bc29691d0e964c32920d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEST.exe

Filesize
37KB

MD5
ca70b79092c1b1e6dc8eb7950864b0ee

SHA1
3396cebc62c348fc96463a73a40eb4e5e6bc09c5

SHA256
2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

SHA512
9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

Download Submit
C:\Users\Admin\AppData\Local\Temp\YT_Bot.exe

Filesize
2.4MB

MD5
240b2940002c38ebb3df80246920a729

SHA1
ecb8fcaf0babe0f000b5f7cceadfb9bc033d0467

SHA256
552a0e05f9fe148b38b8cd34f4dc699654feb0fb98584d5506001742a4d4bb0d

SHA512
d5448e5b3507ac5008ca405c90e7fec49f4594b919677cf4bbe9cd7faabda1ef02713b9a88bf69bc9f21bf986ba9411929e7f2f17cacc083e7af046f037297d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\autB864.tmp

Filesize
47KB

MD5
9dda4db9e90ff039ad5a58785b9d626d

SHA1
507730d87b32541886ec1dd77f3459fa7bf1e973

SHA256
fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe

SHA512
4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cleansaturn.exe

Filesize
3.8MB

MD5
0f597e254135a708137a52470943316c

SHA1
86240613459d76fff43d9995f73c97f75ee680c1

SHA256
8763150d50e887141961f8c027acf92d5698e8e925cc5e76515d6d8fe330cb26

SHA512
408fe3bd85921cdf5576caa55e28213849c07340817c33605a68fa3da72ae512c0ac710b3a3cb4cbff44c5f64cfb0715034604a5de7bf9c5b6adce4919a2f6eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\colorful screen darkener.exe

Filesize
9KB

MD5
757c3888ff96ebc33c2be55f648b8446

SHA1
4be04b6713b83d5e6fb48620a11629a1735dc273

SHA256
73d673b3175a1dc7e77b01537a6de77d1f78c9afc063eab263fd0c24848feb93

SHA512
421d6dcaf8031565fd5eb9a11bd167f9bc198e8622386dcba81354800eb13d533f045c0ae29de05d0d275bba151b5a932aa70f2c5e8b3c073e16170ec2b3e840

Download Submit
C:\Users\Admin\AppData\Local\Temp\concos_1.6.exe

Filesize
15KB

MD5
eed739fea0bc483844ddf8ddcce053d0

SHA1
06e3c942854aa1651069d99279f7f61f7dd6470d

SHA256
72b8b1fb511bbc8c3d883a1b6fa0ad55a731bda7585ab1f5670ab6a5d7a36225

SHA512
0c6621efca8b6b23e10ea6e6db6e7bc16596fb2bed72b703d460ac8b2deb388d6fae9bc8a47a139ab08349546b7c743cd7097aea21c55d469f45a655fb4c32b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\error.exe

Filesize
10KB

MD5
bcdc1a6f1805a6130dfd1913b1659bc2

SHA1
f4b80ac7fe17332f916ce450d29f7ce671e49bb0

SHA256
78e706c684da0134ace5fdd5cc5e7263c5f17b905d783f928eb68d558116aac6

SHA512
0769ecf207e224ceceba33854b457d4389897163037b91141b958762304f64e75af32679c4d6ea88c4cf02aaadde077fef048837ef280a13948e82d69b6358b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\evil.exe

Filesize
23KB

MD5
0e0d73422110762ad112c39647865d09

SHA1
4bb94e94e65a8bc12313783df99b96d89d7fd764

SHA256
02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

SHA512
e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

Download Submit
C:\Users\Admin\AppData\Local\Temp\haha.exe

Filesize
659KB

MD5
6c3817c553a44d2ab916aa4c0574cefc

SHA1
d8858d8140592a557748b711d6a856d0bda3dce3

SHA256
9d2d8b2f908c2c60e3d22d10654e8fd1f7b4116758f6957938791a6defa067d9

SHA512
58a31af89f9e39c5147f7df19f440a75f06b284cd754156bf9cfe18155946c1d34125830bca26d61de195796f00495e44d2b68058dfc7c58fcffb8eb37e751ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\levislocker.exe

Filesize
914KB

MD5
f20c3ceba1ac2530208c3e7b9f954286

SHA1
8bae89f6d3b8376048643397408e63942fd66f27

SHA256
ef2dfff6121e80e3fa88f86da7941f3e9a613f1ed43188be1d8df0a9b39c33cd

SHA512
8a7a63da9ac92469f8c2f1114693777e46836a6e2caeca255c21d49c385af58dad7f43264c14cc62aa65affbe0b2e528a9989129cc476b1d7d5c44c80616202c

Download Submit
C:\Users\Admin\AppData\Local\Temp\malecus.exe

Filesize
15KB

MD5
0e741eb3f92a7a739628d04a5fd4aab9

SHA1
87a8865773a791ab3ca68201cee7a0c3fef2fab3

SHA256
1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85

SHA512
1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nomore.exe

Filesize
150KB

MD5
e8d7c22c43ecaa4f1a2d5ef0f577fd93

SHA1
0f83cbb6387cd4a4a2f1f105c2d21d2720fde6db

SHA256
45384f4c35211b1b462adf78100ccc03b47cdcc984c612711365bd45e633cf6a

SHA512
add9021ebf48b4d9bd1b8cf427719e2e789f85906173bf1e9576fbe907fcb44f90ad7d5ae256c4dff8e1c31e6b280f1d4ba9187eb2b136fb4420eb332b8c7bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss.exe

Filesize
202KB

MD5
e61bc4ecaac4354b240d56fa48c67790

SHA1
c8c83c518188d7adf2a2a485b20e033a6f8a0602

SHA256
4f4732e54644b08be1c2ac9851fb21c947570d674083e9f614f3cbeef3ccf1e6

SHA512
4bec8a6067b1aa9f2b25559c5bac61aa45b90619fb713432824e9e8bd2c06e4193acab18031c7df9eb643bc17b3aa0807b49ce790b13870248f8907ad89c6ccc

Download Submit
C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
memory/348-201-0x0000000000150000-0x0000000000190000-memory.dmp

Filesize
256KB

Download
memory/432-381-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/560-261-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/564-7-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-4-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-134-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-39-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-21-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/564-9-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-40-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-26-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-220-0x0000000003D00000-0x0000000003D02000-memory.dmp

Filesize
8KB

Download
memory/564-138-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-20-0x0000000003E50000-0x0000000003E51000-memory.dmp

Filesize
4KB

Download
memory/564-29-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-217-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-28-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-23-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-2-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-61-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/564-27-0x0000000003D00000-0x0000000003D02000-memory.dmp

Filesize
8KB

Download
memory/564-6-0x0000000002300000-0x000000000338E000-memory.dmp

Filesize
16.6MB

Download
memory/900-209-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1036-420-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/1036-8-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/1036-1-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/1036-30-0x0000000005570000-0x0000000005572000-memory.dmp

Filesize
8KB

Download
memory/1036-340-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/1036-10-0x0000000005570000-0x0000000005572000-memory.dmp

Filesize
8KB

Download
memory/1036-540-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/1036-11-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/1088-18-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1088-231-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1088-228-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/1088-25-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/1592-183-0x0000000004D20000-0x000000000534A000-memory.dmp

Filesize
6.2MB

Download
memory/1592-167-0x00000000025B0000-0x00000000025E6000-memory.dmp

Filesize
216KB

Download
memory/1632-533-0x0000000000400000-0x0000000000DDE000-memory.dmp

Filesize
9.9MB

Download
memory/2032-188-0x0000000000A30000-0x0000000000A3E000-memory.dmp

Filesize
56KB

Download
memory/2332-13-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/2332-5-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/2332-331-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/2332-328-0x0000000004E70000-0x0000000004E72000-memory.dmp

Filesize
8KB

Download
memory/2332-22-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/2332-24-0x0000000004E70000-0x0000000004E72000-memory.dmp

Filesize
8KB

Download
memory/2332-0-0x0000000075341000-0x0000000075342000-memory.dmp

Filesize
4KB

Download
memory/2756-293-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2804-206-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3108-416-0x0000000000C80000-0x000000000106B000-memory.dmp

Filesize
3.9MB

Download
memory/3120-515-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3320-327-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/3568-313-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/3572-107-0x00000000008F0000-0x000000000098A000-memory.dmp

Filesize
616KB

Download
memory/3572-158-0x0000000005F30000-0x0000000005FCC000-memory.dmp

Filesize
624KB

Download
memory/3572-111-0x00000000057A0000-0x0000000005D46000-memory.dmp

Filesize
5.6MB

Download
memory/3572-157-0x0000000005750000-0x000000000575A000-memory.dmp

Filesize
40KB

Download
memory/3572-127-0x0000000005380000-0x00000000056D7000-memory.dmp

Filesize
3.3MB

Download
memory/3572-125-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/3832-16-0x0000000003DB0000-0x0000000003DB2000-memory.dmp

Filesize
8KB

Download
memory/3832-210-0x0000000003DB0000-0x0000000003DB2000-memory.dmp

Filesize
8KB

Download
memory/3832-15-0x0000000003F00000-0x0000000003F01000-memory.dmp

Filesize
4KB

Download
memory/3832-213-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-31-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4080-234-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4504-208-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4892-272-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads