agenttesla | c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3

Analysis

max time kernel
150s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
09/10/2025, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
Size 846KB
Sample251009-sye5js1kt2
SHA256 c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3
MD5 0f74daa5854510d25d42b69aafeff0a5
SHA1 76426a8723ff019f213380ddfd0240ac26868218
SHA512 e50f98cace7f3852987eccbdc14d667cfb4a783f051e64d215793a6087a5dcce4e74f93b171616fc49728880349c90f6ebd02fb7501e2b1da4853163644f558f
SSDEEP 12288:GENN+T5xYrllrU7QY6fz7hU5I5yuNHIgzSFKxWltRohBfSTso93UJeN2CMImQjr8:K5xolYQY6ff+iN57Gtene3sCMIR20x+f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery agenttesla mofksys keylogger persistence spyware stealer trojan upx worm

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.antoniomayol.com:21
Port
21
Username
[email protected]
Password
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Detects Mofksys worm 14 IoCs

resource	yara_rule
behavioral2/memory/2468-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/files/0x001a00000002b084-28.dat	family_mofksys
behavioral2/files/0x001a00000002b08d-42.dat	family_mofksys
behavioral2/memory/388-45-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/files/0x001a00000002b08f-52.dat	family_mofksys
behavioral2/files/0x001a00000002b091-60.dat	family_mofksys
behavioral2/memory/4672-64-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/1948-70-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/4608-77-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/2468-81-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/3684-80-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/files/0x001a00000002b094-82.dat	family_mofksys
behavioral2/memory/388-92-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/4672-93-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys
Mofksys family
mofksys

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\konked.vbs	konked.exe

Executes dropped EXE 7 IoCs

pid	Process
4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
2548	konked.exe
3684	icsys.icn.exe
388	explorer.exe
4608	spoolsv.exe
4672	svchost.exe
1948	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4528-26-0x00000000007F0000-0x000000000093B000-memory.dmp	autoit_exe
behavioral2/memory/2548-86-0x00000000003C0000-0x000000000050B000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 3344	2548	konked.exe	89

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4528-8-0x00000000007F0000-0x000000000093B000-memory.dmp	upx
behavioral2/files/0x001a00000002b087-7.dat	upx
behavioral2/memory/2548-24-0x00000000003C0000-0x000000000050B000-memory.dmp	upx
behavioral2/memory/4528-26-0x00000000007F0000-0x000000000093B000-memory.dmp	upx
behavioral2/memory/2548-86-0x00000000003C0000-0x000000000050B000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	konked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3684	icsys.icn.exe
3684	icsys.icn.exe
388	explorer.exe
388	explorer.exe
388	explorer.exe
388	explorer.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
388	explorer.exe
4672	svchost.exe
4672	svchost.exe
4672	svchost.exe
388	explorer.exe
388	explorer.exe
4672	svchost.exe
388	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
388	explorer.exe
4672	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2548	konked.exe
2548	konked.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
2548	konked.exe
2548	konked.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
2548	konked.exe
2548	konked.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
3684	icsys.icn.exe
3684	icsys.icn.exe
388	explorer.exe
388	explorer.exe
4608	spoolsv.exe
4608	spoolsv.exe
4672	svchost.exe
4672	svchost.exe
1948	spoolsv.exe
1948	spoolsv.exe
388	explorer.exe
388	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4528	2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	78
PID 2468 wrote to memory of 4528	2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	78
PID 2468 wrote to memory of 4528	2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	78
PID 4528 wrote to memory of 2548	4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	79
PID 4528 wrote to memory of 2548	4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	79
PID 4528 wrote to memory of 2548	4528	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	79
PID 2468 wrote to memory of 3684	2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	80
PID 2468 wrote to memory of 3684	2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	80
PID 2468 wrote to memory of 3684	2468	c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe	80
PID 3684 wrote to memory of 388	3684	icsys.icn.exe	81
PID 3684 wrote to memory of 388	3684	icsys.icn.exe	81
PID 3684 wrote to memory of 388	3684	icsys.icn.exe	81
PID 388 wrote to memory of 4608	388	explorer.exe	82
PID 388 wrote to memory of 4608	388	explorer.exe	82
PID 388 wrote to memory of 4608	388	explorer.exe	82
PID 4608 wrote to memory of 4672	4608	spoolsv.exe	83
PID 4608 wrote to memory of 4672	4608	spoolsv.exe	83
PID 4608 wrote to memory of 4672	4608	spoolsv.exe	83
PID 4672 wrote to memory of 1948	4672	svchost.exe	84
PID 4672 wrote to memory of 1948	4672	svchost.exe	84
PID 4672 wrote to memory of 1948	4672	svchost.exe	84
PID 4672 wrote to memory of 5004	4672	svchost.exe	85
PID 4672 wrote to memory of 5004	4672	svchost.exe	85
PID 4672 wrote to memory of 5004	4672	svchost.exe	85
PID 2548 wrote to memory of 3344	2548	konked.exe	89
PID 2548 wrote to memory of 3344	2548	konked.exe	89
PID 2548 wrote to memory of 3344	2548	konked.exe	89
PID 2548 wrote to memory of 3344	2548	konked.exe	89
PID 4672 wrote to memory of 764	4672	svchost.exe	207
PID 4672 wrote to memory of 764	4672	svchost.exe	207
PID 4672 wrote to memory of 764	4672	svchost.exe	207
PID 4672 wrote to memory of 6032	4672	svchost.exe	327
PID 4672 wrote to memory of 6032	4672	svchost.exe	327
PID 4672 wrote to memory of 6032	4672	svchost.exe	327

C:\Users\Admin\AppData\Local\Temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
"C:\Users\Admin\AppData\Local\Temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- \??\c:\users\admin\appdata\local\temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
  c:\users\admin\appdata\local\temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\starbowlines\konked.exe
    c:\users\admin\appdata\local\temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      c:\users\admin\appdata\local\temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3684
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:388
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4608
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4672
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Windows\SysWOW64\at.exe
        
        at 15:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
      - C:\Windows\SysWOW64\at.exe
        
        at 15:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:764
      - C:\Windows\SysWOW64\at.exe
        
        at 15:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe

Path C:\Users\Admin\AppData\Local\Temp\c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
Size 572KB
SHA256 d7d6d49ef689dbdea1522f8772062739a78562b78675c98c1682c5b4fcbe79e0
MD5 948dfa927d1a3832a784a453a9fdf558
SHA1 f505d11903afec4c5a6ffb988d8e02bfdcd805e1
SHA512 6bae519e9b707e8abfdb1ea55261cdb1dd4bce8087772677b31b9ebfc01f75660b731f7feb9ee5ebd9bc26e8b0e6548e517eba77115bb4566822cce2b6e3b7db
SSDEEP 12288:Uz7hU5I5yuNHIgzSFKxWltRohBfSTso93UJeN2CMImQjrTq08c+:Uf+iN57Gtene3sCMIR20x+
MD5 SHA1 SHA512 SSDEEP

Submit Download

molecast

Path C:\Users\Admin\AppData\Local\Temp\molecast
Size 239KB
SHA256 379daf46b5539016f065ada9a712936f431714905d69832d5ddbab1656bd7d94
MD5 1bab1e36dca74bf3e6adbdf199d6f38c
SHA1 2855c243a45f46a6b569102fa8b0b6c13747c72a
SHA512 dcd2f8eb3f9623c68dc549dbf48af1b9dbd628149da7b7ad7c316f3e411965c3d52eb7a518c754bb4a610f2ad24a4953d7174b4932581ae1041e1fbc904fbd22
SSDEEP 6144:X2ymPZFJxQjGhJYBwYm3zgBaPRgr4y3De39:XpmPZFJxoGhCDm38aPW4y4
MD5 SHA1 SHA512 SSDEEP

Submit Download

seskin

Path C:\Users\Admin\AppData\Local\Temp\seskin
Size 39KB
SHA256 040c09ffa81e8ef311272ec61b1d0daf2b495df8fa8323dd44e712a4b97fccff
MD5 0fdc6539914526c9882190a96660896c
SHA1 139ca972dfc8821fe1b0f19ed89995b8e5a6c44e
SHA512 aa716471fe10aa1969e0e2ecf6c67115f7d931b26b78e7d550e31162246360d8d4a3909f186bf8141e7410c54fd56af65cd50d21531e8f445c1974908b679029
SSDEEP 384:5j+nEvLbwq5VlYRckirwZ3yy7yKx9E+KEia6Ovj9ypmB0qqffj1s9kM:5Km5oe3yE+KUymBea
MD5 SHA1 SHA512 SSDEEP

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 274KB
SHA256 2ec6768106ccd3b0ba2712ed213e4cd8effd59717178249c32f24b954f621d87
MD5 c7831794d2c916f855bf0075a512c7b6
SHA1 01fa3b68317c1b31d74b46e694c720e240701bc1
SHA512 60cddd6ea905c3611e21a4405441daea58148245fd6aa5be6adda08c6a19b4d130709872e8562d6b341fd51c53ae660dbda0d9cb0907e815e39727bed0923b99
SSDEEP 3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un9:UvEN2U+T6i5LirrllHy4HUcMQY6K
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 274KB
SHA256 3672d99b73ed65b677f86a700f61b89d683b8cf869632ed15a4395eac9d1e4c1
MD5 cd821c1dbb79b142b32d46afc59c3f74
SHA1 18fc665debfc2143080dd4a5f30a453af51eeec4
SHA512 db8a7898b446905f2047114de87e5eace6d7641ee11b5872d7090913eaaa24acc03768224274cad478b1920ebab37d8dc225b91a68710c8c26f7c48982029af2
SSDEEP 3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un/:UvEN2U+T6i5LirrllHy4HUcMQY6I
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 274KB
SHA256 5f472340b4f5be28d6bbc623d1dca5cd1ec545649493d2c2079d5c7a4b6af978
MD5 4df4e5cf7974773a02ed5f690c27aa3a
SHA1 312750f13706fea8256ad34bf9ac38ca85aa91d9
SHA512 c90d5a94decbd81d14f807178f119190595d38409ae9ef62e4a33dc53d07007c0214ff159a39a3298f48b9e30d713271d83c2494aa46a6b84a19029d952470e9
SSDEEP 3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unn:UvEN2U+T6i5LirrllHy4HUcMQY6+
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 274KB
SHA256 85f04d2dd79150eb135573e46493dc0cceaeb543cb15e13ed7073499385bb0cd
MD5 813dac64571f8036c6ab160a88b451c3
SHA1 f3d9c39d1cc2be35a5d5f11b80c23e287191c573
SHA512 f4230a698412bf5a47ca4cb42a2017025dbce31a781d057eb0308f75270efca8b763434cf157f00d20ec9c75be7d81de0b26fa83e0af8a383ca341bdba04ecf3
SSDEEP 3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unq:UvEN2U+T6i5LirrllHy4HUcMQY6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 274KB
SHA256 0618b77180db6b0cf5d079d6ab7a3f5ab0d96de48e13824ec82799df0aaf3ae7
MD5 78f7429788e99d4254e91a83dff21d07
SHA1 9ab8b2b538599c41be7a58d5abc3bf4148d40d1a
SHA512 c52aff20991a14d74f2532406603b6a4807a7ab853cdfe07c4aa11e8be8a7b960fca1036061a6276d73959a47b3364ef4ba4798359b5b4f71375faa9f22b5934
SSDEEP 3072:UvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unO:UvEN2U+T6i5LirrllHy4HUcMQY6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-92-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/388-45-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-70-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2468-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2468-81-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2548-86-0x00000000003C0000-0x000000000050B000-memory.dmp

Download

memory/2548-24-0x00000000003C0000-0x000000000050B000-memory.dmp

Download

memory/3344-90-0x0000000006190000-0x00000000061E0000-memory.dmp

Download

memory/3344-84-0x0000000000590000-0x00000000005D2000-memory.dmp

Download

memory/3344-87-0x00000000052B0000-0x0000000005856000-memory.dmp

Download

memory/3344-88-0x0000000004E00000-0x0000000004E66000-memory.dmp

Download

memory/3344-89-0x00000000060F0000-0x0000000006182000-memory.dmp

Download

memory/3344-91-0x00000000062D0000-0x00000000062DA000-memory.dmp

Download

memory/3684-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4528-8-0x00000000007F0000-0x000000000093B000-memory.dmp

Download

memory/4528-20-0x0000000001150000-0x0000000001550000-memory.dmp

Download

memory/4528-26-0x00000000007F0000-0x000000000093B000-memory.dmp

Download

memory/4608-77-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4672-64-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4672-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download