glupteba | 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpz72uqk35.exe
Size 9.1MB
Sample260522-1jdl6shw9s
SHA256 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b
MD5 a340c44781a72b9d8b20a2dc9c6d25f9
SHA1 a125287fc868c8adfe44a41bd427b163cdca0bce
SHA512 e3d6f27a5a3ed900b117d917472595255d9d79e6921c945d4648013a58e735f770e3416ed0ab069fc570094166028df63e2321709344a76475953f1ea4273e19
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfbhZytTD5iqJ:sxEvYjVzANzhwN
TLSH
T151A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit trojan

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000284e1-102.dat	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\tmpz72uqk35.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	tmpz72uqk35.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4644	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
3788	csrss.exe
1492	csrss.exe
4980	csrss.exe
1080	csrss.exe
4648	csrss.exe
712	injector.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\tmpz72uqk35.exe = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	tmpz72uqk35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	tmpz72uqk35.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpz72uqk35.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpz72uqk35.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpz72uqk35.exe
File created	C:\Windows\rss\csrss.exe	tmpz72uqk35.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1084	powershell.exe
3952	powershell.exe
4104	powershell.exe
956	powershell.exe
3592	powershell.exe
4292	powershell.exe
2672	powershell.exe
4804	powershell.exe
1088	powershell.exe
3848	powershell.exe
4284	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpz72uqk35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpz72uqk35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1200	schtasks.exe
644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1084	powershell.exe
1084	powershell.exe
1524	tmpz72uqk35.exe
1524	tmpz72uqk35.exe
2672	powershell.exe
2672	powershell.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
3084	tmpz72uqk35.exe
4804	powershell.exe
4804	powershell.exe
3952	powershell.exe
3952	powershell.exe
4104	powershell.exe
4104	powershell.exe
1088	powershell.exe
1088	powershell.exe
4104	powershell.exe
1088	powershell.exe
1492	csrss.exe
1492	csrss.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
1080	csrss.exe
1080	csrss.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
3788	csrss.exe
3788	csrss.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
712	injector.exe
3788	csrss.exe
3788	csrss.exe
712	injector.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeIncreaseQuotaPrivilege	1084	powershell.exe
Token: SeSecurityPrivilege	1084	powershell.exe
Token: SeTakeOwnershipPrivilege	1084	powershell.exe
Token: SeLoadDriverPrivilege	1084	powershell.exe
Token: SeSystemProfilePrivilege	1084	powershell.exe
Token: SeSystemtimePrivilege	1084	powershell.exe
Token: SeProfSingleProcessPrivilege	1084	powershell.exe
Token: SeIncBasePriorityPrivilege	1084	powershell.exe
Token: SeCreatePagefilePrivilege	1084	powershell.exe
Token: SeBackupPrivilege	1084	powershell.exe
Token: SeRestorePrivilege	1084	powershell.exe
Token: SeShutdownPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeSystemEnvironmentPrivilege	1084	powershell.exe
Token: SeRemoteShutdownPrivilege	1084	powershell.exe
Token: SeUndockPrivilege	1084	powershell.exe
Token: SeManageVolumePrivilege	1084	powershell.exe
Token: 33	1084	powershell.exe
Token: 34	1084	powershell.exe
Token: 35	1084	powershell.exe
Token: 36	1084	powershell.exe
Token: SeDebugPrivilege	1524	tmpz72uqk35.exe
Token: SeImpersonatePrivilege	1524	tmpz72uqk35.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2672	powershell.exe
Token: SeIncreaseQuotaPrivilege	2672	powershell.exe
Token: SeSecurityPrivilege	2672	powershell.exe
Token: SeTakeOwnershipPrivilege	2672	powershell.exe
Token: SeLoadDriverPrivilege	2672	powershell.exe
Token: SeSystemtimePrivilege	2672	powershell.exe
Token: SeBackupPrivilege	2672	powershell.exe
Token: SeRestorePrivilege	2672	powershell.exe
Token: SeShutdownPrivilege	2672	powershell.exe
Token: SeSystemEnvironmentPrivilege	2672	powershell.exe
Token: SeUndockPrivilege	2672	powershell.exe
Token: SeManageVolumePrivilege	2672	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4804	powershell.exe
Token: SeIncreaseQuotaPrivilege	4804	powershell.exe
Token: SeSecurityPrivilege	4804	powershell.exe
Token: SeTakeOwnershipPrivilege	4804	powershell.exe
Token: SeLoadDriverPrivilege	4804	powershell.exe
Token: SeSystemtimePrivilege	4804	powershell.exe
Token: SeBackupPrivilege	4804	powershell.exe
Token: SeRestorePrivilege	4804	powershell.exe
Token: SeShutdownPrivilege	4804	powershell.exe
Token: SeSystemEnvironmentPrivilege	4804	powershell.exe
Token: SeUndockPrivilege	4804	powershell.exe
Token: SeManageVolumePrivilege	4804	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3952	powershell.exe
Token: SeIncreaseQuotaPrivilege	3952	powershell.exe
Token: SeSecurityPrivilege	3952	powershell.exe
Token: SeTakeOwnershipPrivilege	3952	powershell.exe
Token: SeLoadDriverPrivilege	3952	powershell.exe
Token: SeSystemtimePrivilege	3952	powershell.exe
Token: SeBackupPrivilege	3952	powershell.exe
Token: SeRestorePrivilege	3952	powershell.exe
Token: SeShutdownPrivilege	3952	powershell.exe
Token: SeSystemEnvironmentPrivilege	3952	powershell.exe
Token: SeUndockPrivilege	3952	powershell.exe
Token: SeManageVolumePrivilege	3952	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1084	1524	tmpz72uqk35.exe	85
PID 3084 wrote to memory of 2672	3084	tmpz72uqk35.exe	96
PID 3084 wrote to memory of 1104	3084	tmpz72uqk35.exe	99
PID 1104 wrote to memory of 4644	1104	cmd.exe	101
PID 3084 wrote to memory of 4804	3084	tmpz72uqk35.exe	102
PID 3084 wrote to memory of 3952	3084	tmpz72uqk35.exe	104
PID 3084 wrote to memory of 3788	3084	tmpz72uqk35.exe	107
PID 3788 wrote to memory of 4104	3788	csrss.exe	110
PID 1492 wrote to memory of 1088	1492	csrss.exe	112
PID 3788 wrote to memory of 956	3788	csrss.exe	119
PID 4980 wrote to memory of 3592	4980	csrss.exe	129
PID 1080 wrote to memory of 4292	1080	csrss.exe	131
PID 3788 wrote to memory of 3848	3788	csrss.exe	133
PID 4648 wrote to memory of 4284	4648	csrss.exe	136
PID 3788 wrote to memory of 712	3788	csrss.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe
"C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpz72uqk35.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4104
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1200
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:956
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:712
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:644

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3592

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b0f9cae7ea248a3bc31f948a1efe46a49acce56c3070eb2585db17839175be64
MD5 0b756f791b67b0879780eccd91529209
SHA1 b4c1c7ccb86ffa90bfca9fd47b516f0768d55e0a
SHA512 5a41ba14b2cc60aa8d128b4134ffca56ddd5b00bf15798681eee25bd4fa3263f96430e11538b98aafaaca73500a09e5d5f075d4ace221edbbec74af7c92a6dd8
TLSH
T1C2416B303131B4D94D826F1215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 23KB
SHA256 72d7739348b007d37393d7c7ca5c8374e1120329d8ff66d0c8ec37fe10f566ed
MD5 cab6883dc1173549628ba667d384907f
SHA1 4903662342025f19261f7c5bebc27ee7fe2c2bb6
SHA512 1c95602c5492114484af9d15042e550693652ac750ed608f2f1c5ee329966e22f1f75807f304193b294beae1b884f59c90d216875ca1f026baf5b449f418514d
SSDEEP 384:atfQnQyaijQLiwHVcs2C1sf94gQ1d6uGNT8Ch6wYGbL2z/GiKqivz5AZyKLDyQa2:qfsVfjkb12C186AuGZ8O6VGeTKq2N+p
TLSH
T1EFB2E82621FB4DEBDAC511B0858901FEFFE0D8419A3876CCEB2EE7586CD6D765230264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 23KB
SHA256 f56c3ab6a0378129fd3dc93b3e7fefee7cc6681dddce2ace84fb257cafb8575f
MD5 4926bb5818b2a18ee3b76d0759bcc5bd
SHA1 67b28461486ee2e8d8081c9bf27bbf80bbf5d3fd
SHA512 eda0a30289b73053adc5c3d30d161cc87f0bca60ebce9204eb109e826d3f031c21f548fc6f05a27c9bab0fc2c329a038bccb435bbbc1e140286f0a055858a3c6
SSDEEP 384:RtfQnQyfbjd/QtVcXqMraH9UXY+8C55gV7Rocx/BQqi24tt5rcZ6Ke2egtn:PfsVfbiNMrsU98JVd7cqz+t4Y2
TLSH
T1A5B2E90E66E74DEFD6C560614588439BDFE4E910533166CEEB0FA6197CCB83CA6603E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tbjnukrg.h3k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tbjnukrg.h3k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 730aff8c9e430a9f9e5e44f1c376e57f42fa5adc744824df2f69855009473592
MD5 f811272c20ff6decbbd16ff364334427
SHA1 cb31be66c972daa61d45920fa2fa824c1dfb194d
SHA512 5c68bf3a41c3607cad5abe94f2bb3816f3e69426fa7d43bf7c9787c4e9ce6660b1843a2e505a22a93d7008b76fc564078513fe9ef47051e5b6fc344ab9d0a528
TLSH
T14F417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 d5943c5bb1b3fd6378df3e7c27d5b14cde020822aa4284e6b6d240cbe3ed1305
MD5 947e98effbc732500121ce1ebbea4269
SHA1 eddcd1815b5abf4a764be8a2dd96476e9ef46830
SHA512 7cf6b85f3f2c4a4419e9cbbe6a86cc3e713344b6b9703ac2cedde9cddca905c7d7c9b5bc6462fd0156298d7d0f0b1a6efa15462830f2f456a71fd29675fb769a
SSDEEP 384:nhQD3jhasMdW0fnVcXqMriWKBFN8cJAkG7d8GOJJiDc4uPC5yzEIGD2n:hgjhasMIQzMrHIFN8c2x8GgJiYfPCQEu
TLSH
T19CA22A2926FB4CDEC9C610A159CD4B89DFE4DD5253A422CEE71EAA1E1CC783D5A200FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 fd8eaa8a426035c06a95dcc346af385baccf93fb851e596e9b5f62228f388295
MD5 8cdbb5f843bc0d076c9859fbc208c8c3
SHA1 84db33ff1719c377d89d81d80b422759db0540b1
SHA512 4a7d4036499da0207429ce9bc5ec2e9b2545174b8db4223bc761fd147a8815ddca742ec4b4bdaea5f4b0ac1908143568c61442a18ad96883167b1e901e8b7caa
SSDEEP 384:OtfQDO7NYHyiglBwnAq6uosDX4JAkr67TzGOJJFi4vP5ypJ2GDbn:efB7uHyfSz6fOvzGgJFiYP8f
TLSH
T1D2A2E92D36EB48DFCAC460A149894796DBE4DD5163A162CFE74FB90E5C8783C95101FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 5dc98a16001c6d20579b18c10ba3c784e1f76000f661904249c88080ec77b952
MD5 1cde619677d9f256c5347a5766477390
SHA1 ef4297b222317da0b0d00808fba3e9abd5db3c4c
SHA512 aec78b4c2a018bafb778535ba3cc5665d86ef66555fa2fb0b458fb082b3db7ee094aefef91f345f3125a933e7afc10b6fb3da67daf1df415d281d559270b952c
SSDEEP 384:AhQD33BD289u5cs9MryKKBFN8cJAkLq7hgGOJJiD0PC5ym2wDcn:Gg3R9i9MrzIFN8c7qFgGgJiuCrc
TLSH
T1F7A2F82D66F78CFFC6C060614588478EEFE4D95093B562CEE71EA91E18C783D96100EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 af82ebd91e19e2c57243cca9404858aac7fb8a3343febfcd2e01e6a2e97a34e9
MD5 6b7819843c626b58d5e896b73dc517df
SHA1 c7ebe069ca4ff282621765673f8f4cf3359dc7b9
SHA512 624d52544882c007f04446b4da6bad9a423e330b226e794b8550f55fcd1596fb96b79807e4bb348020877e42d4aca1a329ed0c18329ab0363dc98e0ba9a280a1
SSDEEP 384:stfQDyR9YMG3nlMqMrOLXAFN8cJAkG7HPGOJJFm4vP5yiPs2GDnn:EflR9YzZMrxFN8cWzPGgJFmYPwb
TLSH
T140A2E82D26AB4DDFCAC660A145C94B8AEFE4DD1163A162CFE74FA91E58C783C95100FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 80427de34d54f4a62d6bdd42020d7348814ab01c60858a4e39b521b0cc6d78bb
MD5 9c9adc2f40c136753d674c270a1a842f
SHA1 64965cbadfb5fb33c4cabcb7a69c984b81c4fe7c
SHA512 9c23461c751836dd17533a80d053fee9a530edd9891f27b85301eddc458ae73ab6491229d89a4c9899e5202a996b65016187e753394fa9f3587b87df0138a6ec
SSDEEP 384:NhQDy0Tx5r/WnZqMrKWKBFN8cJAk+7LrGONJiFJP5yVHJ2U5bn:bleXasMrfIFN8cOfrGwJi7PSB
TLSH
T109A2191D26EB4CDEDAC420A159894B8AEFE4DD11A3B561CEE71EBA1E1CC783D55100FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 7924fdadb5e9eaa97961c9f56e0309c5d1210ac567714c637d8b65ee608f6945
MD5 e31e3bd1f2ff90448a677a3fc09e5198
SHA1 1f2a9531b0f88ddf36ef45d088a756b658e64bd8
SHA512 11177ee17cca985286b0890ea671045a6b09b8d4ce1cd8c94777b0e9641678b9e888d42d248f096b14571b3b90893304de63bb7db3216d517b95975d30f8c024
SSDEEP 384:ehQDuaQx9r5T/cVcs2C1sfJ48lIFN8cH1MXksdL+ucaiNzV5M/7NlHJtv:YF/x9r62C1AzlIFN8i1MsaiRbO
TLSH
T177A2D93520B78DF5DAC515B056990AEEFFD4D8419BB872CCAB2DFA1D4CE2D3A9220064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 7e3f191cc94512b65d2eb234e7d4efdc63e313d471c402970a1699a763ed20bd
MD5 51fd555154ddce6f5235be969822b5c5
SHA1 ffbf19301266ade1cd4ec1a1a81d44079230af30
SHA512 34e1d23d792006899c4515f13c9e2a113b8fccfefaccd3c45e82b814301007d7e48e9f85b77efaaf95fa45056ca61ad45580dcdb8f63cbe0e95c123ae11f6545
SSDEEP 384:uhQD3LsIDXUescXqMrO2QJAkHC7dwGONJiz0PC5ymJKoDAn:IgLsIrU3MrzQSxwGwJi+Cno
TLSH
T18FA2F71D26EB4CCED6C560A15989438ADBE4ED1153B562CFEB0FBA0E5CD683DA6100FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 6b03bb79a0dc335e541567ae09f7cc689c10915a3f49aebacfb7301d1bc4ad4b
MD5 a340c44781a72b9d8b20a2dc9c6d25f9
SHA1 a125287fc868c8adfe44a41bd427b163cdca0bce
SHA512 e3d6f27a5a3ed900b117d917472595255d9d79e6921c945d4648013a58e735f770e3416ed0ab069fc570094166028df63e2321709344a76475953f1ea4273e19
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANfbhZytTD5iqJ:sxEvYjVzANzhwN
TLSH
T151A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-155-0x0000000006810000-0x000000000685C000-memory.dmp

Download

memory/956-157-0x0000000070D60000-0x0000000070DAC000-memory.dmp

Download

memory/956-153-0x00000000062C0000-0x0000000006617000-memory.dmp

Download

memory/956-158-0x0000000070EE0000-0x0000000071237000-memory.dmp

Download

memory/1084-23-0x0000000070EB0000-0x0000000070EFC000-memory.dmp

Download

memory/1084-20-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Download

memory/1084-28-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/1084-26-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/1084-35-0x0000000007F30000-0x0000000007F4E000-memory.dmp

Download

memory/1084-36-0x0000000007F50000-0x0000000007FF3000-memory.dmp

Download

memory/1084-37-0x0000000008030000-0x000000000803A000-memory.dmp

Download

memory/1084-38-0x00000000080E0000-0x0000000008176000-memory.dmp

Download

memory/1084-16-0x00000000069E0000-0x0000000006A2C000-memory.dmp

Download

memory/1084-15-0x0000000006930000-0x000000000694E000-memory.dmp

Download

memory/1084-14-0x0000000006310000-0x0000000006667000-memory.dmp

Download

memory/1084-18-0x0000000007C80000-0x0000000007CF6000-memory.dmp

Download

memory/1084-6-0x0000000006230000-0x0000000006296000-memory.dmp

Download

memory/1084-24-0x0000000071040000-0x0000000071397000-memory.dmp

Download

memory/1084-1-0x00000000052E0000-0x0000000005316000-memory.dmp

Download

memory/1084-0-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/1084-2-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/1084-3-0x00000000059F0000-0x00000000060BA000-memory.dmp

Download

memory/1084-22-0x0000000007ED0000-0x0000000007F02000-memory.dmp

Download

memory/1084-4-0x00000000058F0000-0x0000000005912000-memory.dmp

Download

memory/1084-27-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/1084-21-0x000000007F8B0000-0x000000007F8C0000-memory.dmp

Download

memory/1084-17-0x0000000006F10000-0x0000000006F54000-memory.dmp

Download

memory/1084-5-0x00000000061C0000-0x0000000006226000-memory.dmp

Download

memory/1084-19-0x0000000008380000-0x00000000089FA000-memory.dmp

Download

memory/1088-134-0x0000000070F20000-0x0000000070F6C000-memory.dmp

Download

memory/1088-135-0x0000000071280000-0x00000000715D7000-memory.dmp

Download

memory/2672-59-0x0000000007B80000-0x0000000007C23000-memory.dmp

Download

memory/2672-51-0x0000000071140000-0x0000000071497000-memory.dmp

Download

memory/2672-50-0x0000000070FC0000-0x000000007100C000-memory.dmp

Download

memory/2672-49-0x0000000006E80000-0x0000000006ECC000-memory.dmp

Download

memory/2672-48-0x0000000006520000-0x0000000006877000-memory.dmp

Download

memory/3592-182-0x0000000070EE0000-0x0000000071237000-memory.dmp

Download

memory/3592-181-0x0000000070D60000-0x0000000070DAC000-memory.dmp

Download

memory/3848-211-0x0000000070D60000-0x0000000070DAC000-memory.dmp

Download

memory/3848-221-0x0000000007720000-0x00000000077C3000-memory.dmp

Download

memory/3848-212-0x0000000070EE0000-0x0000000071237000-memory.dmp

Download

memory/3952-91-0x0000000071140000-0x0000000071497000-memory.dmp

Download

memory/3952-90-0x0000000070FC0000-0x000000007100C000-memory.dmp

Download

memory/4104-125-0x0000000071280000-0x00000000715D7000-memory.dmp

Download

memory/4104-124-0x0000000070F20000-0x0000000070F6C000-memory.dmp

Download

memory/4104-122-0x0000000006930000-0x000000000697C000-memory.dmp

Download

memory/4104-106-0x0000000006280000-0x00000000065D7000-memory.dmp

Download

memory/4104-133-0x0000000007B60000-0x0000000007C03000-memory.dmp

Download

memory/4284-231-0x0000000070D60000-0x0000000070DAC000-memory.dmp

Download

memory/4284-240-0x0000000007580000-0x0000000007623000-memory.dmp

Download

memory/4284-232-0x0000000070EE0000-0x0000000071237000-memory.dmp

Download

memory/4292-201-0x0000000070EE0000-0x0000000071237000-memory.dmp

Download

memory/4292-209-0x0000000007E80000-0x0000000007F23000-memory.dmp

Download

memory/4292-200-0x0000000070D60000-0x0000000070DAC000-memory.dmp

Download

memory/4804-73-0x0000000071310000-0x0000000071667000-memory.dmp

Download

memory/4804-72-0x0000000070FC0000-0x000000007100C000-memory.dmp

Download

memory/4804-70-0x00000000056D0000-0x0000000005A27000-memory.dmp

Download