Overview
overview
10Static
static
10Key Generator.exe
windows10-2004-x64
7Key Generator.exe
windows11-21h2-x64
7BitcoinGenerator.exe
windows10-2004-x64
10BitcoinGenerator.exe
windows11-21h2-x64
10LoL Hack &...ks.exe
windows10-2004-x64
10LoL Hack &...ks.exe
windows11-21h2-x64
10Welrast_64.exe
windows10-2004-x64
7Welrast_64.exe
windows11-21h2-x64
7Analysis
- max time kernel
900s - max time network
717s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
07/10/2025, 19:41
Behavioral task
behavioral1
Sample
Key Generator.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
Key Generator.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
BitcoinGenerator.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral4
Sample
BitcoinGenerator.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral5
Sample
LoL Hack & Cheat Map Hacks/LoL Hack & Cheat Map Hacks.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral6
Sample
LoL Hack & Cheat Map Hacks/LoL Hack & Cheat Map Hacks.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral7
Sample
Welrast_64.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral8
Sample
Welrast_64.exe
Resource
win11-20250610-en
windows11-21h2-x64
11 signatures
900 seconds
General
- Target Welrast_64.exe
- Size 2.7MB
- Sample251007-yd535askz3
- SHA256 123423017a860591694b92eaf14eb3b633d80899c00b0d34d525469e79e6c340
- MD5 49853690ee7cbec3703fcd75b06d7ce3
- SHA1 2d150763434a61c39634769e7563211e040fc0fe
- SHA512 5b993c40965c2df9ffd5eccb0e4e3fea0a24e001775bb1ddfd0a62826f12166843f49200fb766787f17fca64253904cd901b4030137a8033da055cb8b3dada9d
- SSDEEP 49152:oLGgjkiZrCiximtlVwcOSgEbTehBjHsYrNN2TF6wk8TAnXk/U:oHkiZrHTVw77yeffAPk8Sks
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 2860 fdfbvd.exe 3408 advasv.exe 2912 dascsaCV.exe 3824 dzvsac.exe 2352 TimeManager.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Time Manager = "C:\\ProgramData\\TimeManager.exe" Explorer.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdfbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dascsaCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language advasv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dzvsac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TimeManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Welrast_64.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Explorer.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 advasv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz advasv.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2912 dascsaCV.exe 2912 dascsaCV.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3324 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2912 dascsaCV.exe Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeShutdownPrivilege 3324 Explorer.EXE - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5920 wrote to memory of 2860 5920 Welrast_64.exe 79 PID 5920 wrote to memory of 2860 5920 Welrast_64.exe 79 PID 5920 wrote to memory of 2860 5920 Welrast_64.exe 79 PID 2860 wrote to memory of 3408 2860 fdfbvd.exe 80 PID 2860 wrote to memory of 3408 2860 fdfbvd.exe 80 PID 2860 wrote to memory of 3408 2860 fdfbvd.exe 80 PID 2860 wrote to memory of 2912 2860 fdfbvd.exe 81 PID 2860 wrote to memory of 2912 2860 fdfbvd.exe 81 PID 2860 wrote to memory of 2912 2860 fdfbvd.exe 81 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2912 wrote to memory of 3324 2912 dascsaCV.exe 52 PID 2860 wrote to memory of 3824 2860 fdfbvd.exe 82 PID 2860 wrote to memory of 3824 2860 fdfbvd.exe 82 PID 2860 wrote to memory of 3824 2860 fdfbvd.exe 82 PID 3324 wrote to memory of 5060 3324 Explorer.EXE 84 PID 3324 wrote to memory of 5060 3324 Explorer.EXE 84 PID 5060 wrote to memory of 2352 5060 cmd.exe 86 PID 5060 wrote to memory of 2352 5060 cmd.exe 86 PID 5060 wrote to memory of 2352 5060 cmd.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\Welrast_64.exe"C:\Users\Admin\AppData\Local\Temp\Welrast_64.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Roaming\fdfbvd.exe"C:\Users\Admin\AppData\Roaming\fdfbvd.exe" -s -ptdgndgmsratgg4hfsghsrfH3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\advasv.exe"C:\Users\Admin\AppData\Roaming\advasv.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3408
-
-
C:\Users\Admin\AppData\Roaming\dascsaCV.exe"C:\Users\Admin\AppData\Roaming\dascsaCV.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
-
-
C:\Users\Admin\AppData\Roaming\dzvsac.exe"C:\Users\Admin\AppData\Roaming\dzvsac.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3824
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\TimeManager.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\ProgramData\TimeManager.exeC:\ProgramData\TimeManager.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\TimeManager.exe
- Size 240KB
- SHA256 9b7649f38281623b6bad16b3687f2865b972c6a99608f7adcd742a6260cab334
- MD5 fa294daf40f95a0f0450e8434d283547
- SHA1 b29210bd633ad89421a41aaee5354f9b2cdf0332
- SHA512 44ed983f8ad767f6b62aaba250d7fda3d94a2b3183f2244d0d6608954b1e3edd7630d88b3ef4f97770593a1c537cc17681ffa9a965a5983aeb9b00b1a36b60ed
- SSDEEP 3072:6GtGMyegYZI4xoH3MnKEpmViQ1Tf3KLSfqouG:dEMy5hH3MHpLQwUqon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\advasv.exe
- Size 48KB
- SHA256 f02f97d5e28ba69e50ab74318890d6657382fc982ce2c77a4ef326bb20495aaf
- MD5 7824383a3b8c6c18cb1e6e8758118513
- SHA1 3cc1cee9ea8eaf65373148a016749724498c556a
- SHA512 5fc7ab68166fa3fff3c7f4ab5f6bf354b5c475b7eb8bc554221d91a76388aee6417fe6035531eaad3575349e85abc5932841c6edec930ea47d35b890736bfa92
- SSDEEP 768:SVHumLEiQILpaYQsyM+ylaPGLFhjo7dkaQU7W:SVOiEiQILLjKPQU7W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\dascsaCV.exe
- Size 240KB
- SHA256 e56fa8a40c953d96e66273be75ac51a8213c3057233b199b18d13dbd5f0fb7c1
- MD5 fb00504fec16c83eb6db4649f3090507
- SHA1 7104d9628a5620d8c298054cbddb57b76d6cb882
- SHA512 ebb899017a1667ffbde30c5a957351092e022db2a0d10a0620fd08252c9c4da78d5603e4776f1b332040af08cc7a7c488829ce2d1ebe8b84d89e6945701ebd73
- SSDEEP 3072:wGtGMyegYZI4xoH3MnKEpmViQ1Tf3KLSfqouG:3EMy5hH3MHpLQwUqon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\dzvsac.exe
- Size 6.4MB
- SHA256 0558952b7f3be72afaa7bddd8d94d432e1dcf0a690f336083e3801bc268b9866
- MD5 63cbcf78ddc6011aad67938693058f68
- SHA1 b81e37479268b4756e8eecc0679a84934c214cfd
- SHA512 6040f2891f2830677366b8e7639dab0f9d302924994b2614197144df0e94559e7a2b20efc837428317a7d614872770d440c003362598ac1d4759d657bdbed181
- SSDEEP 98304:9EY/ZL780myvACvMv0/++cBZmEqAVbBJFtRdyX3O:9EYBL7rmyvEN+l3AV7fWO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\fdfbvd.exe
- Size 2.8MB
- SHA256 a533c1f2705efed579475faad2fd72eb3d40ce5ff653ff1588accf3fa450fcf2
- MD5 3e1e601fddb3e1cfca88ab98cb974c94
- SHA1 06b7d33475ac39f30ef0c2949ea9b1f2249cb061
- SHA512 c34a6f761f58150e1144df97647111e820a4f51f39dbc2a8a7bd036b624dc0e2f3653b677af20bbe8e8ad261b252bb31fca12886e143d2ac6438ca8bdb5bfc6a
- SSDEEP 49152:g5rAGgVkiXFKiVeExlV+oUG+UnJehzXHqYhN/SPJ8wcaFCnnwBP5:g5gkiXF/jV+fbKq9L+BcaEwf
- MD5 SHA1 SHA512 SSDEEP