xworm | c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c

Analysis

user interaction
yes
max time kernel
58s
max time network
60s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/05/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
1442.exe
Size 28KB
Sample260509-aev3jsfy3s
SHA256 c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c
MD5 070d580cc3ee8bd7bba0268f953cff9a
SHA1 37db0f82dd66114275757526d3f54400e658dd16
SHA512 39c23e9b226b8073a98dcb1b5ac07f45f053a3835db03295b42489e914792d49b448a5e0c10340061d7d1a21aa5bc4a12af7a8dbbf554233e0e758ba6d747932
SSDEEP 384:71BLpDUYN2Z0u4ocfQYcQzVEI2yKYymNru/ttQ9a9stDLq2OUOOu3LTShQ:npIYN2jcfQjyKtkru/LQIM6hUDhQ
TLSH
T127D2BE2552C54236DBAE0F365C63B39147B2F316ED7B8F7F18D4E12AEEA32488522131
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

lmfao1337.ddns.net:1337

Mutex

UiR5OIZFhVEO2o6k

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000028475-12.dat	family_xworm
behavioral1/memory/4188-24-0x0000000000070000-0x0000000000080000-memory.dmp	family_xworm

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\Control Panel\International\Geo\Nation	1442.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\Control Panel\International\Geo\Nation	System32.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	System32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	System32.exe

Executes dropped EXE 3 IoCs

pid	Process
4188	System32.exe
1792	System32.exe
3548	ieliuv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\System32.exe"	System32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	ieliuv.exe
File opened (read-only)	\??\G:	ieliuv.exe
File opened (read-only)	\??\H:	ieliuv.exe
File opened (read-only)	\??\L:	ieliuv.exe
File opened (read-only)	\??\N:	ieliuv.exe
File opened (read-only)	\??\O:	ieliuv.exe
File opened (read-only)	\??\R:	ieliuv.exe
File opened (read-only)	\??\S:	ieliuv.exe
File opened (read-only)	\??\J:	ieliuv.exe
File opened (read-only)	\??\W:	ieliuv.exe
File opened (read-only)	\??\Z:	ieliuv.exe
File opened (read-only)	\??\B:	ieliuv.exe
File opened (read-only)	\??\I:	ieliuv.exe
File opened (read-only)	\??\M:	ieliuv.exe
File opened (read-only)	\??\Q:	ieliuv.exe
File opened (read-only)	\??\T:	ieliuv.exe
File opened (read-only)	\??\A:	ieliuv.exe
File opened (read-only)	\??\K:	ieliuv.exe
File opened (read-only)	\??\P:	ieliuv.exe
File opened (read-only)	\??\U:	ieliuv.exe
File opened (read-only)	\??\V:	ieliuv.exe
File opened (read-only)	\??\X:	ieliuv.exe
File opened (read-only)	\??\Y:	ieliuv.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	ieliuv.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\Control Panel\Desktop\Wallpaper	ieliuv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieliuv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2260	taskkill.exe
4404	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "173"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	ieliuv.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626041545-1565650712-3224088082-1000\{0206A0F6-6838-47F4-86F4-3B5574059F3D}	ieliuv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6076	WMIC.exe
6076	WMIC.exe
6076	WMIC.exe
6076	WMIC.exe
2980	WMIC.exe
2980	WMIC.exe
2980	WMIC.exe
2980	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	System32.exe
Token: SeDebugPrivilege	4188	System32.exe
Token: SeDebugPrivilege	1792	System32.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeShutdownPrivilege	3548	ieliuv.exe
Token: SeCreatePagefilePrivilege	3548	ieliuv.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeIncreaseQuotaPrivilege	6076	WMIC.exe
Token: SeSecurityPrivilege	6076	WMIC.exe
Token: SeTakeOwnershipPrivilege	6076	WMIC.exe
Token: SeLoadDriverPrivilege	6076	WMIC.exe
Token: SeSystemProfilePrivilege	6076	WMIC.exe
Token: SeSystemtimePrivilege	6076	WMIC.exe
Token: SeProfSingleProcessPrivilege	6076	WMIC.exe
Token: SeIncBasePriorityPrivilege	6076	WMIC.exe
Token: SeCreatePagefilePrivilege	6076	WMIC.exe
Token: SeBackupPrivilege	6076	WMIC.exe
Token: SeRestorePrivilege	6076	WMIC.exe
Token: SeShutdownPrivilege	6076	WMIC.exe
Token: SeDebugPrivilege	6076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6076	WMIC.exe
Token: SeRemoteShutdownPrivilege	6076	WMIC.exe
Token: SeUndockPrivilege	6076	WMIC.exe
Token: SeManageVolumePrivilege	6076	WMIC.exe
Token: 33	6076	WMIC.exe
Token: 34	6076	WMIC.exe
Token: 35	6076	WMIC.exe
Token: 36	6076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6076	WMIC.exe
Token: SeSecurityPrivilege	6076	WMIC.exe
Token: SeTakeOwnershipPrivilege	6076	WMIC.exe
Token: SeLoadDriverPrivilege	6076	WMIC.exe
Token: SeSystemProfilePrivilege	6076	WMIC.exe
Token: SeSystemtimePrivilege	6076	WMIC.exe
Token: SeProfSingleProcessPrivilege	6076	WMIC.exe
Token: SeIncBasePriorityPrivilege	6076	WMIC.exe
Token: SeCreatePagefilePrivilege	6076	WMIC.exe
Token: SeBackupPrivilege	6076	WMIC.exe
Token: SeRestorePrivilege	6076	WMIC.exe
Token: SeShutdownPrivilege	6076	WMIC.exe
Token: SeDebugPrivilege	6076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6076	WMIC.exe
Token: SeRemoteShutdownPrivilege	6076	WMIC.exe
Token: SeUndockPrivilege	6076	WMIC.exe
Token: SeManageVolumePrivilege	6076	WMIC.exe
Token: 33	6076	WMIC.exe
Token: 34	6076	WMIC.exe
Token: 35	6076	WMIC.exe
Token: 36	6076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2980	WMIC.exe
Token: SeSecurityPrivilege	2980	WMIC.exe
Token: SeTakeOwnershipPrivilege	2980	WMIC.exe
Token: SeLoadDriverPrivilege	2980	WMIC.exe
Token: SeSystemProfilePrivilege	2980	WMIC.exe
Token: SeSystemtimePrivilege	2980	WMIC.exe
Token: SeProfSingleProcessPrivilege	2980	WMIC.exe
Token: SeIncBasePriorityPrivilege	2980	WMIC.exe
Token: SeCreatePagefilePrivilege	2980	WMIC.exe
Token: SeBackupPrivilege	2980	WMIC.exe
Token: SeRestorePrivilege	2980	WMIC.exe
Token: SeShutdownPrivilege	2980	WMIC.exe
Token: SeDebugPrivilege	2980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2980	WMIC.exe
Token: SeRemoteShutdownPrivilege	2980	WMIC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3548	ieliuv.exe
3548	ieliuv.exe
5400	LogonUI.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 4196	5740	1442.exe	83
PID 5740 wrote to memory of 4188	5740	1442.exe	85
PID 4196 wrote to memory of 5072	4196	cmd.exe	86
PID 4188 wrote to memory of 1936	4188	System32.exe	94
PID 4188 wrote to memory of 3548	4188	System32.exe	100
PID 3548 wrote to memory of 4452	3548	ieliuv.exe	101
PID 4452 wrote to memory of 2260	4452	cmd.exe	103
PID 4452 wrote to memory of 4404	4452	cmd.exe	104
PID 4452 wrote to memory of 6076	4452	cmd.exe	105
PID 4452 wrote to memory of 2980	4452	cmd.exe	106
PID 4452 wrote to memory of 5524	4452	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1442.exe
"C:\Users\Admin\AppData\Local\Temp\1442.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1442.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\mode.com
    mode con: cols=100 lines=30
    3⤵
    PID:5072
- C:\Users\Admin\AppData\Local\Temp\System32.exe
  "C:\Users\Admin\AppData\Local\Temp\System32.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Users\Admin\AppData\Roaming\System32.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\ieliuv.exe
    "C:\Users\Admin\AppData\Local\Temp\ieliuv.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies WinLogon
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' set FullName='UR NEXT'
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6076
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' rename 'UR NEXT'
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown /f /r /t 0
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524

C:\Users\Admin\AppData\Roaming\System32.exe
"C:\Users\Admin\AppData\Roaming\System32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c5855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 25a4c997b52b17dea9413306165719cd0959c2349ac726884ce7f863e794599b
MD5 38daa2a2a6a517f796090ddf1f184cf6
SHA1 00e102208cc57444340695323694ead65cd9ad3b
SHA512 4a0720fcef077d6fc195095479c0e5636b0a16df4fbd5610a15b6718ca6c64b55e660b785ca26912e41f985520564654b436c8b9b1d3fc32eda9b39ed0202e27
SSDEEP 1536:JD69tQeoVYoIYpktMG0e2ra/p1Y4LL+GqEMi0:JDCtUFk3Ca/5+6
TLSH
T1FC153F37A464A098DF3C35B1E5AD2F4DBD32651A12E002421F74727FBA233D9DA0B5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1442.bat

Path C:\Users\Admin\AppData\Local\Temp\1442.bat
Size 1KB
SHA256 61378a1ba4700876659848d553fa1caa5a5748ff9255af13cd2f539b3ae1bfdc
MD5 691cb7efa6ca2ceb7455475895dc871b
SHA1 0ec4c83db438dcc469b5fd5b29d04f8efa8b13e5
SHA512 6102d0abbcb24681892bda526bded56d6dcd951dbc3cdabd45eec4d0ef7106fd8873134cf2f5b02e692422c38c6f7f198199e9e597f14b02922b923912f69e8b
TLSH
T1BD31E3613D38D4526CE2DD8B1F7E9497FBA2128F01289DA4B23F09F367046C9799EC64
MD5 SHA1 SHA512 TLSH

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Local\Temp\System32.exe
Size 35KB
SHA256 99552727ef350dcd99949e3fff24f15f291cdb1934ba45b19186e8b164522e7f
MD5 68d56ada5fe011d53f8850b249fdc6ef
SHA1 89542145476e1ec8652ba7089cc36dd664a115ed
SHA512 7a4403e89e6313d4abfea6c724ebeb8ed38ae99b356ee3db001f159710e5e024f7d75a6e97b6b468b889bf87c66e93dc12580554b1e3d6dcea39e22b294e48e5
SSDEEP 768:lkGLMt53p91cw2F5LFy19OkYO/hcyySG:S7TDMTF49OkYO/RG
TLSH
T1BCF25C4937A18726D5ED5FF86A73A2020574F6079D27EB5E0CC885AE7B37BC18A013E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieliuv.exe

Path C:\Users\Admin\AppData\Local\Temp\ieliuv.exe
Size 6.7MB
SHA256 4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
MD5 d5671758956b39e048680b6a8275e96a
SHA1 33c341130bf9c93311001a6284692c86fec200ef
SHA512 972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7
SSDEEP 3072:V3LA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuzzo9Y:lLJlC6j0CX4XmvWHVcd62uo9
TLSH
T12766F29B5ECC82E2FD3E05314062F676A6647EE903E14FCB62F80D47FA502E56C7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

one.rtf

Path C:\Users\Admin\AppData\Local\Temp\one.rtf
Size 403B
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064
TLSH
T162E0ABB65C82D2C5018D15AA9E5040190F1D8E7AACB6A5CEB40AAC10B2A549C70809D2
MD5 SHA1 SHA512 TLSH

Submit Download

rniw.exe

Path C:\Users\Admin\AppData\Local\Temp\rniw.exe
Size 76KB
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877
SSDEEP 1536:3vosBknP2Uo+GjDZwue3jzFfcdhghUuV+ETNOh:3vVMCcHVcdhghUuzE
TLSH
T134735A83B6C10772C68146B145B23AB6C735973A87269FD7D34C5A07AFA44F1CCB22DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\text.txt
Size 396B
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f
MD5 SHA1 SHA512

Submit Download

windl.bat

Path C:\Users\Admin\AppData\Local\Temp\windl.bat
Size 771B
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6
TLSH
T1FF0128835579212398372F7C93CBEE479014DC1928C44B5739EF686AA7A2454B029BDE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1792-102-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Download

memory/3548-83-0x000000000CAA0000-0x000000000CAB0000-memory.dmp

Download

memory/3548-76-0x000000000CAA0000-0x000000000CAB0000-memory.dmp

Download

memory/3548-54-0x0000000000190000-0x000000000083E000-memory.dmp

Download

memory/3548-105-0x0000000006A80000-0x0000000006ABB000-memory.dmp

Download

memory/3548-72-0x000000000C0C0000-0x000000000C0CE000-memory.dmp

Download

memory/3548-71-0x000000000CA40000-0x000000000CA78000-memory.dmp

Download

memory/3548-56-0x00000000062D0000-0x0000000006876000-memory.dmp

Download

memory/3548-84-0x000000000CB60000-0x000000000CB70000-memory.dmp

Download

memory/3548-77-0x000000000CAA0000-0x000000000CAB0000-memory.dmp

Download

memory/3548-79-0x000000000CAA0000-0x000000000CAB0000-memory.dmp

Download

memory/3548-78-0x000000000CAA0000-0x000000000CAB0000-memory.dmp

Download

memory/3548-80-0x000000000CB60000-0x000000000CB70000-memory.dmp

Download

memory/3548-81-0x000000000CB60000-0x000000000CB70000-memory.dmp

Download

memory/3548-82-0x000000000CAA0000-0x000000000CAB0000-memory.dmp

Download

memory/3548-104-0x0000000005170000-0x0000000005206000-memory.dmp

Download

memory/4188-27-0x0000000000810000-0x000000000081C000-memory.dmp

Download

memory/4188-26-0x000000001AE30000-0x000000001AE40000-memory.dmp

Download

memory/4188-24-0x0000000000070000-0x0000000000080000-memory.dmp

Download

memory/4188-28-0x000000001AE30000-0x000000001AE40000-memory.dmp

Download

memory/5740-23-0x00000000023C0000-0x00000000023CC000-memory.dmp

Download

memory/5740-1-0x000000001AF30000-0x000000001AF40000-memory.dmp

Download

memory/5740-0-0x0000000000470000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads