donutloader | 446fda0e27f236057ce5c6720c00da778b1ddd51ee78eaaf127f3ce754fc623b

Analysis

max time kernel
149s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe
Size 17.2MB
Sample260511-kcktxadt4x
SHA256 446fda0e27f236057ce5c6720c00da778b1ddd51ee78eaaf127f3ce754fc623b
MD5 15b747808cf4341c67e27f18f319bea4
SHA1 03357e67b784ef6c191ed72585566734daf3dcca
SHA512 020ceed5ee8b4a3537ed4ca7c53dfeb520c15c00008295364226648894c5f5130a421627eb348b5823057f7132defc9f5e0fae0092326afae179f5f47a795043
SSDEEP 98304:KB5A8GxiuoaN5zNpYU+XNSY4/3pAePUN9tk:KB/Gtt5zNaUyM/3KNP
TLSH
T1320733A63789D9B5CA6303BC1965CAB08773ED911F11D38716E0BE037A326D12EB5387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader loader persistence spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5064-60-0x0000020CEB140000-0x0000020CEB325000-memory.dmp	family_donutloader

Custom signature

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/5064-61-0x0000020CEBD90000-0x0000020CEBF76000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/5064-61-0x0000020CEBD90000-0x0000020CEBF76000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b079-54.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/5064-55-0x0000020CD06F0000-0x0000020CD0800000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2188	powershell.exe
1092	powershell.exe
5900	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	Updater.exe

Executes dropped EXE 8 IoCs

pid	Process
4792	7z.exe
4624	7z.exe
5492	7z.exe
5484	7z.exe
4888	7z.exe
5064	Updater.exe
5264	CoreWorker_uAiDssFFiZsYbQu.exe
4632	CoreWorker_uAiDssFFiZsYbQu.exe

Loads dropped DLL 5 IoCs

pid	Process
4792	7z.exe
4624	7z.exe
5492	7z.exe
5484	7z.exe
4888	7z.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_uAiDssFFiZsYbQu = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_uAiDssFFiZsYbQu.exe"	Updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_uAiDssFFiZsYbQu = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_uAiDssFFiZsYbQu.exe"	CoreWorker_uAiDssFFiZsYbQu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_uAiDssFFiZsYbQu = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_uAiDssFFiZsYbQu.exe"	CoreWorker_uAiDssFFiZsYbQu.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe
5064	Updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4792	7z.exe
Token: 35	4792	7z.exe
Token: SeSecurityPrivilege	4792	7z.exe
Token: SeSecurityPrivilege	4792	7z.exe
Token: SeRestorePrivilege	4624	7z.exe
Token: 35	4624	7z.exe
Token: SeSecurityPrivilege	4624	7z.exe
Token: SeSecurityPrivilege	4624	7z.exe
Token: SeRestorePrivilege	5492	7z.exe
Token: 35	5492	7z.exe
Token: SeSecurityPrivilege	5492	7z.exe
Token: SeSecurityPrivilege	5492	7z.exe
Token: SeRestorePrivilege	5484	7z.exe
Token: 35	5484	7z.exe
Token: SeSecurityPrivilege	5484	7z.exe
Token: SeSecurityPrivilege	5484	7z.exe
Token: SeRestorePrivilege	4888	7z.exe
Token: 35	4888	7z.exe
Token: SeSecurityPrivilege	4888	7z.exe
Token: SeSecurityPrivilege	4888	7z.exe
Token: SeDebugPrivilege	5064	Updater.exe
Token: SeDebugPrivilege	5064	Updater.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	5264	CoreWorker_uAiDssFFiZsYbQu.exe
Token: SeDebugPrivilege	5264	CoreWorker_uAiDssFFiZsYbQu.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeIncreaseQuotaPrivilege	5900	powershell.exe
Token: SeSecurityPrivilege	5900	powershell.exe
Token: SeTakeOwnershipPrivilege	5900	powershell.exe
Token: SeLoadDriverPrivilege	5900	powershell.exe
Token: SeSystemProfilePrivilege	5900	powershell.exe
Token: SeSystemtimePrivilege	5900	powershell.exe
Token: SeProfSingleProcessPrivilege	5900	powershell.exe
Token: SeIncBasePriorityPrivilege	5900	powershell.exe
Token: SeCreatePagefilePrivilege	5900	powershell.exe
Token: SeBackupPrivilege	5900	powershell.exe
Token: SeRestorePrivilege	5900	powershell.exe
Token: SeShutdownPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeSystemEnvironmentPrivilege	5900	powershell.exe
Token: SeRemoteShutdownPrivilege	5900	powershell.exe
Token: SeUndockPrivilege	5900	powershell.exe
Token: SeManageVolumePrivilege	5900	powershell.exe
Token: 33	5900	powershell.exe
Token: 34	5900	powershell.exe
Token: 35	5900	powershell.exe
Token: 36	5900	powershell.exe
Token: SeIncreaseQuotaPrivilege	5900	powershell.exe
Token: SeSecurityPrivilege	5900	powershell.exe
Token: SeTakeOwnershipPrivilege	5900	powershell.exe
Token: SeLoadDriverPrivilege	5900	powershell.exe
Token: SeSystemProfilePrivilege	5900	powershell.exe
Token: SeSystemtimePrivilege	5900	powershell.exe
Token: SeProfSingleProcessPrivilege	5900	powershell.exe
Token: SeIncBasePriorityPrivilege	5900	powershell.exe
Token: SeCreatePagefilePrivilege	5900	powershell.exe
Token: SeBackupPrivilege	5900	powershell.exe
Token: SeRestorePrivilege	5900	powershell.exe
Token: SeShutdownPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeSystemEnvironmentPrivilege	5900	powershell.exe
Token: SeRemoteShutdownPrivilege	5900	powershell.exe
Token: SeUndockPrivilege	5900	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 244	4132	2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe	78
PID 244 wrote to memory of 3440	244	cmd.exe	80
PID 244 wrote to memory of 4792	244	cmd.exe	81
PID 244 wrote to memory of 4624	244	cmd.exe	82
PID 244 wrote to memory of 5492	244	cmd.exe	83
PID 244 wrote to memory of 5484	244	cmd.exe	84
PID 244 wrote to memory of 4888	244	cmd.exe	85
PID 244 wrote to memory of 5032	244	cmd.exe	86
PID 244 wrote to memory of 5064	244	cmd.exe	87
PID 5064 wrote to memory of 5000	5064	Updater.exe	89
PID 5064 wrote to memory of 744	5064	Updater.exe	90
PID 5064 wrote to memory of 5000	5064	Updater.exe	89
PID 5064 wrote to memory of 744	5064	Updater.exe	90
PID 5064 wrote to memory of 1860	5064	Updater.exe	93
PID 1860 wrote to memory of 2188	1860	cmd.exe	95
PID 5064 wrote to memory of 5264	5064	Updater.exe	96
PID 5264 wrote to memory of 5900	5264	CoreWorker_uAiDssFFiZsYbQu.exe	97
PID 5264 wrote to memory of 2680	5264	CoreWorker_uAiDssFFiZsYbQu.exe	99
PID 2680 wrote to memory of 1092	2680	cmd.exe	101

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5032	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_15b747808cf4341c67e27f18f319bea4_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e file.zip -p1395114089652129610602112253 -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\system32\attrib.exe
    attrib +H "Updater.exe"
    3⤵
    - Views/modifies file attributes
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
    "Updater.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:744
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
      "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_uAiDssFFiZsYbQu-744' -RunLevel Highest "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5900
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:984

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
1⤵
- Executes dropped EXE
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
MD5 e60feda9a7e775a7d83cc6ec30a00f68
SHA1 b258b886f3cba5a97922f2695ebeaedafe3638ef
SHA512 51dae2882602a7ef7b3e43cc8745cc6fd974beae26a17730c928d4e82dc19dbb66287d9431cc6bd1990a7278c546cd3f9a51eeb6debd73eacf2803ee303c70e2
TLSH
T153218633B7ACC234C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85fe8ed3fc48c6b103275a82eaa1de0e1763a611162e253fa4b75aaa53f1ea3a
MD5 22accbe8bd64f5c5cb6b2209e3b4f3ab
SHA1 a9597b0e6eaa6e3b3ec5137a5de6bfd2ca0d0336
SHA512 623d7923b56bf5396662f64b0f7b74b5481089280cacdcc4f46cad82d844bd0373ed0c3b0e0026367acaa71d6df76bf8f24d1b9d517929f3291f303ade3c0b20
TLSH
T180218933B79CC134C8D911BA108DAD01B2B5C3D7449ECECB7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

CoreWorker_uAiDssFFiZsYbQu.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_uAiDssFFiZsYbQu.exe
Size 13KB
SHA256 26f5da8506e000681e9658af3572fdcf7a8a0e8dbcc315bc63f68e1301b986a1
MD5 6eb27bb4ac12fea3710797eaa387192c
SHA1 770019d72f4a11957695aed4a39868ab1b47648d
SHA512 50cced8d5a969fc5c7c5870553610405e7a0cf2dbdcc42757586be852f23a3d8d50ae0804a0e2922c3baabdea60fa502cebb5dcf0e95c3dbc37f04412011f443
SSDEEP 192:o3ED4poDaVm2iJJdMBizTcPKw+rmbQSaZxGKxOkhEVVEMKRDTQ7W7vm:uEyVmciw+rmbQSgxLQR/EMKxgW7v
TLSH
T1DC52D804A7E48139D6BA0F749EB265105A33F7564932CE1F258C928B5B27380EDE2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rsuyokca.3k2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rsuyokca.3k2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
TLSH
T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\main\Updater.exe
Size 1.0MB
SHA256 30a69ebcfce22e0a4944730a59d5ee1bcbd4ae5fe65687dafa540d2e7d9778ea
MD5 d2a75acfccac69f196cde58a3ebb278c
SHA1 dc59342b304702f04f9f465ab15404535d14f943
SHA512 db7dedb1c4da81caf53f914f98ae425096792b019b9ae694dc66e20e02b0c5836cfc6225dd9aad8bc5f6db6af1d04b17ac250d811c72c1fc2d54df17a4cb06e5
SSDEEP 24576:eXgCOX6eCAblLznOnK4s8UdF7asuBPL2XV9:eXgCC7b4c3bavj2X
TLSH
T16535CF0527E6DE01E23E637D406482C843FDA9045D86DF5693E53AFB2BCE392EB1614B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 2.3MB
SHA256 fcdf109fb9fa0a0b1fd144485b6ea5cf2a5240f26ef83b7cc0385cc3a8137d84
MD5 6a55c444121a04447c71197c480321ad
SHA1 d379ed3135fe3ddd64cf465163415b2c7c5d7d2f
SHA512 b58e2814a2e3b856a17e7ba729e5b8d95060089c0e2de62e195d1fc4f98c2fd518b5e25ff566750f3f41f8a57f4032ebf48a594cb9bfe518e76c84f68ba5d0cc
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xK:R9kqGu7okoZscCnf0/Zs9L
TLSH
T1BEB501E4B7C8BCC68B9E93D7A1518EAE133311FB9993548C0586BBC91E1B785DF1C884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 770KB
SHA256 2f878444723205f387783f3700e2072407b4a0df736b104eeda83e39a8a6f028
MD5 4dbcdf568c451801f12457bbdb296e61
SHA1 2aa1d0fe9cabcd510991cd34764da75d58f23cb0
SHA512 000ee749808274839ef9be2b8bfe5bee143b4f7d4503902e74d4310dc6a087311bd662b6e0e4fee748aeb960524663b92b576a10211eee060512ed6baea2739f
SSDEEP 24576:bOX88cuXsxvvgRZ6nC671UWgBFnj6krckx:bCLcxHcm1U7vttx
TLSH
T163F433EF1FC5468393061C99BD239A3F795490C3522AAC526E59F025287C9E3D34B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 770KB
SHA256 ce153a984ef45091eb34478e6a0ac72184dcea951ef1f94c8d15874506f2f270
MD5 3354eea67dfd25452bae4511f0d0d6f0
SHA1 5f739a96f83c3029a4bebe55d48c4f68ca7f06f9
SHA512 66295216cf81825eac92c64cb6bcb7fb0b4e9e5d2b9ab43d1f98ccb81364a895724200ff1f1f3b27c598d775579d3a6490bbc82a6d83daab380b5e1df0aec86a
SSDEEP 24576:MOX88cuXsxvvgRZ6nC671UWgBFnj6krckA:MCLcxHcm1U7vttA
TLSH
T133F433AF1FC5468393060C99BD279A3F795490C3522AAC526E99F0212C7C9E3D74B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
Size 770KB
SHA256 46d3f2fdcf4b80a67d683394351cb275caff03b5988ea4d1ce7f4fdad40f819a
MD5 8c15b2c50866363ca58011ca2c417cab
SHA1 4a8d367dbec18780c626619864fd35e4ac67f171
SHA512 bb538cb73ac665f5844333210647c2d3b7925990334dbbbf3cd6e338696bebbe3b648df4f76b1e6610c5ea54962563eb86a05f18df2f5ad48ff89c5d7f7d2a87
SSDEEP 24576:0OX88cuXsxvvgRZ6nC671UWgBFnj6krck0:0CLcxHcm1U7vtt0
TLSH
T1B3F433AF1FC5468393061C99BD239A3F795490C3522AAC526E99F0212C7C9E3D74B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
Size 2.4MB
SHA256 668b0195bf459b849bce15bb90cdf21d0a299bebccb85191e43dd59e47874f75
MD5 aeb4a12b45ac7ea963ae7cc3204eec5d
SHA1 62292ee821e1f9fd0837164ffde4dc83cce28990
SHA512 fc2338b442a8efbf4f7b14a1a0e62f67e3cb0423faea6a7de8444de2fcb5729217486005394fbbf4c2b2e2f838378e4bf0978bf53a6e94e3ee56c0a67048e168
SSDEEP 49152:4ujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oYLCLcxHcm1U7vtth:4aR3D0Ae5mwdkDWm1Xo+8gFUBth
TLSH
T1B3C5334D08B68BF7EA152C381D2BC622A973A0F2621B59F52DCC310415BD5BEAD4E13F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 2.4MB
SHA256 4ec5cfd0553ca9165f5021602d8c5d1231e88c779b36d88a570369039dd0012f
MD5 2d60b08c42670880710861c4faed33cd
SHA1 f38c55a98a30f8222f3b2816e0b364c94a645b90
SHA512 8dfe8f6308f6925357fd5c6385a26987eee68ed0221aa64e446145dcc30dcc93c65c07223363f351895e0fd7a9cfb6642500d4777f57f4b876983ec5d4cd5168
SSDEEP 49152:x/pTEO+hj4+9pcYwXl/7PYN3fcA9DQOyF/Ern3i5Aq2/NsEe:bTIhj4aZEhsn3uAq2/WEe
TLSH
T14EC533AAD2347FA4C1BDDA7C8684F563AC43CD7AB8F3165E4A018CE1205B05B357B66C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 464B
SHA256 75fb0befa04df727eba0d58863592ec246bf163d4ccf5928aa3b5a4940212a27
MD5 a9270718ee710487a6b319b05f59438f
SHA1 113df2464ee013a139283c8e6e2fe1b0e57c716f
SHA512 186bb4b291d9753b02f6649e6b38019b631404a009c68885078f416d9f44627fc3b6767d543c7ef74fe8b7a8ff2aafd4ab6fe1813a9fda1e702dcb88b7665643
TLSH
T1D7F0274024C7C9B24CD5268A07882DD67527945AC12F4F002AE000EE64198DCD4CBFAB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/744-64-0x000002285FC50000-0x000002285FC60000-memory.dmp

Download

memory/1092-163-0x000002012AC80000-0x000002012AC92000-memory.dmp

Download

memory/1092-162-0x000002012AC70000-0x000002012AC78000-memory.dmp

Download

memory/1092-161-0x00000201290F0000-0x00000201290FC000-memory.dmp

Download

memory/2188-102-0x0000021726490000-0x00000217264A2000-memory.dmp

Download

memory/2188-95-0x000002173EDA0000-0x000002173EDA8000-memory.dmp

Download

memory/2188-93-0x000002173ED90000-0x000002173ED9A000-memory.dmp

Download

memory/2188-92-0x000002173EDB0000-0x000002173EDCC000-memory.dmp

Download

memory/2188-91-0x000002173EC30000-0x000002173EC3A000-memory.dmp

Download

memory/2188-90-0x000002173EB70000-0x000002173EC23000-memory.dmp

Download

memory/2188-89-0x000002173E940000-0x000002173E95C000-memory.dmp

Download

memory/2188-94-0x000002173EDF0000-0x000002173EE0A000-memory.dmp

Download

memory/2188-101-0x0000021726410000-0x0000021726418000-memory.dmp

Download

memory/2188-100-0x00000217263D0000-0x00000217263DC000-memory.dmp

Download

memory/2188-97-0x000002173EDE0000-0x000002173EDEA000-memory.dmp

Download

memory/2188-96-0x000002173EDD0000-0x000002173EDD6000-memory.dmp

Download

memory/2188-81-0x00000217264E0000-0x0000021726502000-memory.dmp

Download

memory/3440-13-0x00000197403D0000-0x0000019740473000-memory.dmp

Download

memory/4624-30-0x0000023B9E740000-0x0000023B9E7E3000-memory.dmp

Download

memory/4792-21-0x000002ADC7800000-0x000002ADC78A3000-memory.dmp

Download

memory/4888-51-0x0000026613A80000-0x0000026613B23000-memory.dmp

Download

memory/5000-66-0x000002093A3B0000-0x000002093A3CE000-memory.dmp

Download

memory/5000-65-0x0000020938DF0000-0x0000020938E00000-memory.dmp

Download

memory/5064-71-0x0000020CEAC60000-0x0000020CEAC68000-memory.dmp

Download

memory/5064-55-0x0000020CD06F0000-0x0000020CD0800000-memory.dmp

Download

memory/5064-72-0x0000020CEADD0000-0x0000020CEADD9000-memory.dmp

Download

memory/5064-59-0x0000020CEB670000-0x0000020CEBB98000-memory.dmp

Download

memory/5064-56-0x0000020CD23C0000-0x0000020CD23C1000-memory.dmp

Download

memory/5064-70-0x0000020CD24F0000-0x0000020CD24FC000-memory.dmp

Download

memory/5064-69-0x0000020CEB580000-0x0000020CEB5D0000-memory.dmp

Download

memory/5064-60-0x0000020CEB140000-0x0000020CEB325000-memory.dmp

Download

memory/5064-61-0x0000020CEBD90000-0x0000020CEBF76000-memory.dmp

Download

memory/5064-125-0x0000020CEADD0000-0x0000020CEADD9000-memory.dmp

Download

memory/5064-123-0x0000020CD24F0000-0x0000020CD24FC000-memory.dmp

Download

memory/5064-57-0x0000020CEAE70000-0x0000020CEB032000-memory.dmp

Download

memory/5064-58-0x0000020CEAD20000-0x0000020CEAD96000-memory.dmp

Download

memory/5064-63-0x0000020CEADF0000-0x0000020CEAE02000-memory.dmp

Download

memory/5264-122-0x0000021005B10000-0x0000021005B1A000-memory.dmp

Download

memory/5484-44-0x0000023F5D0B0000-0x0000023F5D153000-memory.dmp

Download

memory/5492-37-0x000001F26C8D0000-0x000001F26C973000-memory.dmp

Download

memory/5900-158-0x00000187AAF60000-0x00000187AAF72000-memory.dmp

Download

memory/5900-146-0x00000187C3340000-0x00000187C33F3000-memory.dmp

Download

memory/5900-157-0x00000187A92E0000-0x00000187A92E8000-memory.dmp

Download

memory/5900-156-0x00000187A92A0000-0x00000187A92AC000-memory.dmp

Download