glupteba | a6f28f4025e36b67edeae2ff846b402bd34b1a541572e38de2b007429d3fc401

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpimu4b6l1.exe
Size 9.1MB
Sample260522-1p9lsshx71
SHA256 a6f28f4025e36b67edeae2ff846b402bd34b1a541572e38de2b007429d3fc401
MD5 c22eabee5e50ca520f023dc176280533
SHA1 7ef2e8be12543a8c190396054c2c843685043d23
SHA512 086cc096477dc3a1db62a4e26d0e5ba0ee6d337a143186294f500313f733a63f28c8af0b16b0e9076f1d0e5d7682055b0c3c7e1345eadd49220ce71a40497b57
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf4hZytTD5iqY:sxEvYjVzANghwN
TLSH
T1A1A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit spyware trojan

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral3/files/0x001500000002b041-102.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1388	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4852	csrss.exe
2472	csrss.exe
2900	csrss.exe
1796	csrss.exe
1872	csrss.exe
5116	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpimu4b6l1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
11	raw.githubusercontent.com

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpimu4b6l1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpimu4b6l1.exe
File created	C:\Windows\rss\csrss.exe	tmpimu4b6l1.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4416	powershell.exe
2088	powershell.exe
2440	powershell.exe
4184	powershell.exe
2316	powershell.exe
232	powershell.exe
3764	powershell.exe
2488	powershell.exe
2928	powershell.exe
1956	powershell.exe
4188	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpimu4b6l1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpimu4b6l1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1852	schtasks.exe
4580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4184	powershell.exe
4184	powershell.exe
4548	tmpimu4b6l1.exe
4548	tmpimu4b6l1.exe
2316	powershell.exe
2316	powershell.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
3156	tmpimu4b6l1.exe
232	powershell.exe
232	powershell.exe
3764	powershell.exe
3764	powershell.exe
2488	powershell.exe
2488	powershell.exe
4416	powershell.exe
4416	powershell.exe
2928	powershell.exe
2928	powershell.exe
2088	powershell.exe
2088	powershell.exe
2472	csrss.exe
2472	csrss.exe
1956	powershell.exe
1956	powershell.exe
2900	csrss.exe
2900	csrss.exe
2440	powershell.exe
2440	powershell.exe
4188	powershell.exe
4188	powershell.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
4852	csrss.exe
5116	injector.exe
4852	csrss.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
4852	csrss.exe
4852	csrss.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe
5116	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	4548	tmpimu4b6l1.exe
Token: SeImpersonatePrivilege	4548	tmpimu4b6l1.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2472	csrss.exe
Token: SeImpersonatePrivilege	2472	csrss.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	2900	csrss.exe
Token: SeImpersonatePrivilege	2900	csrss.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeSystemEnvironmentPrivilege	4852	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4184	4548	tmpimu4b6l1.exe	82
PID 3156 wrote to memory of 2316	3156	tmpimu4b6l1.exe	87
PID 3156 wrote to memory of 4668	3156	tmpimu4b6l1.exe	89
PID 4668 wrote to memory of 1388	4668	cmd.exe	91
PID 3156 wrote to memory of 232	3156	tmpimu4b6l1.exe	92
PID 3156 wrote to memory of 3764	3156	tmpimu4b6l1.exe	94
PID 3156 wrote to memory of 4852	3156	tmpimu4b6l1.exe	96
PID 4852 wrote to memory of 2488	4852	csrss.exe	97
PID 2472 wrote to memory of 4416	2472	csrss.exe	101
PID 4852 wrote to memory of 2928	4852	csrss.exe	113
PID 2900 wrote to memory of 2088	2900	csrss.exe	117
PID 1796 wrote to memory of 1956	1796	csrss.exe	120
PID 4852 wrote to memory of 2440	4852	csrss.exe	123
PID 1872 wrote to memory of 4188	1872	csrss.exe	125
PID 4852 wrote to memory of 5116	4852	csrss.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe
"C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpimu4b6l1.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2488
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1852
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:784
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5116
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4580

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1956

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 16b89f06c21a43014a84221ddce417936ad5f34d09bfa0d1585603ee4c0cb273
MD5 3a05610d7e36fddd0a1a831a11f8ffdb
SHA1 e8a7ce4a68021416d355c4e6a18faadbbe76993d
SHA512 6ff577be48e772de56cb9a20f27286f91ee5d10ebede5f982dde42654cac24e849aeb46be51bdcfedd75227f5fd8cdb6344349b5d8f568edb1f49865112891be
SSDEEP 384:LL3HhwtSS1Y8YXRFRHE4wPPHnnN7jQGIZKLj5rsUjj+GyEID7iJkLOj9VFy:/x8SSwvRRG/N7jfIZKL9rxj+F9D7iCLr
TLSH
T19692D6AE711F16C3C88553B8D206040FE8F2DE8D031956DDB72E8F7B89AC95E917D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 b100a70bd39c4d1176363bc62797b12b131a2c97d74a16b9a9ae1b4d61821f3b
MD5 a719029e6973b8f9ed590d11b9c49879
SHA1 ddcab0270afadfab05d68285b5fdc66ce23bbf7a
SHA512 51fab8068c9bef03a1f6fbaa25e788b16dfe0ed7f32abe4bb9f9c8fabfcdaaec23b9e7bdae84ad731141080f7eb5650b7aa5458acbe003df774daec4bdedc30c
SSDEEP 384:fXTHhwz1SSpAj2Hck6FRTaB6THINjWaK2h2GmeVdq4GexyM0WxLnnY9phAUd5H:flISSCqV6RmBawjWaBhZ5Vw8kWlY9p2y
TLSH
T1B192096D622F2A97C8A923B9C422079FE9B18EDF430097DD6719583B06CF66044BD5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_g0g3c3px.unz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g0g3c3px.unz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ec69e35bd2b6700139238635a2be29a4eb9500ac2d25847bc447d899839d0f96
MD5 5e0aeee80dd3755243e2d501eb5ebbfb
SHA1 b72c4edbe2dcd46d1fadb77ec45a34b1cc8122ac
SHA512 ff7835e2db0eed4c22e21f6337a864786fff23e8ed581656259b7cb6e94c54fe225697d9652ad3de5fc01415d021481ed7994f1f9f8efa40e4175b73ea6d3c88
SSDEEP 384:FL3HhwiSt5WfnzR3bFXs1uTantjWa1ICmLNXjGYq4bazSnY9jhUdN7H:9KiSuPzR5cIijWa1ICmLNzGYZbaz99l6
TLSH
T1BE9229AD226F26D7C4A523F4C016039FE8F09ECF434457DE67196E3B06CA67684A85F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6630e37ad168e012be7861d898c0f8ce5ccec9a77d899385cd14fa99f2e1afa9
MD5 62236c5f413f62a28eb390be2c8cb8b2
SHA1 7f8e5bdd39592e583e4372d6c6e0f9a9c4a91238
SHA512 99a5e7d5a0902cc799bd11eda1bd0ff30f33effd2a9bbb1c6c5211392c5d20d7892b11d60d26867ec5e810e7263860f8f0d50be4c842eb3fcf67632c312ce0ea
SSDEEP 384:zL3HhpSStE7LLGa2E/6lnBvjWa13eLNXjS/4b48zynY9jhUdwH:nfSSMLn2ESvvjWa13eLNz/bfzd9lUs
TLSH
T1B492196D226F2657D86553F8C426078BF8F09ECF830097CEA71A5D3B06DB27180AD5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5434aed52ec3def607fac25ea317f9c3c4073b13f325848b2d93eea23bb3964f
MD5 b35d387812ec816cef7c813bff55c53d
SHA1 71202dec55fb008b773d9a4c8f5b3d912e5023bd
SHA512 b857dcdb0ebe0974820f86063e36855820ce76f90adb33dfc4cdcb8a262fcf2a8d761b1ba709cfac54ad5a83e2cddcb10ca9da4ffee9c5023cb204ad2af5604c
SSDEEP 384:/L3HhFS2kJt9LRSFRm6RQN8Htjc2QNXE4b2zynY9jhUdkH:jbS3JwRmX8NjvQNDb2zd9lU4
TLSH
T144920769225F2657E46163B8E421078BF9F0AACEC380D6DE57095C3A05CF661C4E96FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 bb7b3d22dfcd64a12c230f918bd853876d56585614538dc8e7ef717c5aa14dc1
MD5 afc345a1e175977e0bf3a6162b72e690
SHA1 0bb23260682e0c6916502ee1a40aa206df956c5a
SHA512 a7ef13db037e22191df3119754b7eadbf23253a2d0b28c9bfb88fdddeade09b51f0acff3048f17a363146b94afd7ce0b81f450ac1be038fcb14bdc941ddd9d76
SSDEEP 384:+PHhpS2k/fO+XAFRHEtRgseHTzhCaK2ANXjQHbra6ivnY9jhUdoH:sS3XO+4RAg7TNCaBANzwb+6iw9lUE
TLSH
T10592295D326F269BE4A523B8C026079FE9F18ECEC34053DD6359593B09CE66484EC5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 724B
SHA256 0b3b20019f39155c22149c6bb6c96d6a5212c43f9ae01f30451a0e788dde2992
MD5 5c84be75f3654c538b8819d8d9f18d27
SHA1 b184b3115618cca244e6903f4f649ba26526777f
SHA512 7f7b70a901cc5beb790e9018e52ccde70d85ca65f065f1588999bfbc0878afbc166858c05500e3ec3eedf07a2a65db821f317174983067a72480adc573166548
TLSH
T1DD01AC32F34DD039C8A5027A288CFA123634D3C74086EECF3684C118EE57846CB783A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 fb387274ce528d9db0da959d0cdf5afe0d6276d560bcacbbe62d704cbdaf55e7
MD5 e9f3ce012bdee8f6ee0bc90250b960d3
SHA1 4b799d9034d55584a425201243fc903fbf248f51
SHA512 5a493025597528e9efd68cbfa8cec4203f808c4c20f75fcead85f1b70fdf6afb72e3659ccff9cdf1eeec9e52a0cb99310c82078a55d627351f0340fc1be18578
SSDEEP 384:EL3HhwiSJQRQ6qlEMEkraZ6CGzjQGII+NXjg2xZb3zHzkRjNudFm:qKiS36qlEUzjfII+NzgCZb3zzk+do
TLSH
T14F92D69E611F26C3C8D653B8D107050FE8F2EE8D031A12D8BB2E9F7B89AC55E917D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2db75f840434ea84b611858eb0295ecc7e1b5c50fc29601215b93f5280fc0862
MD5 0fc5efaf721cef326e9f364315ecc3b1
SHA1 8d4c33f4cfd4bb3b45c0a84cf01a4580c626db11
SHA512 5e5fd2941f0cdf87cb8a58a904c34f1200ba7493e4a75a89c50ba1dc1a19738e5b5e6b23fdbc14f18d2255ba747fdf1ef21857f2fe7c1606215aeb5b0242ac1a
SSDEEP 384:lYL3HhwSStgbLbWa6RebLrznCjQGICas+NXyAm4bni7enY9jhUd9H:0KSSCPbTNXejfICas+NPbi7B9lUr
TLSH
T14B92276D326F168BD5A123F5C422078AFCE09ACF8344D6DE9309993A05DB2B184E95F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 a6f28f4025e36b67edeae2ff846b402bd34b1a541572e38de2b007429d3fc401
MD5 c22eabee5e50ca520f023dc176280533
SHA1 7ef2e8be12543a8c190396054c2c843685043d23
SHA512 086cc096477dc3a1db62a4e26d0e5ba0ee6d337a143186294f500313f733a63f28c8af0b16b0e9076f1d0e5d7682055b0c3c7e1345eadd49220ce71a40497b57
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf4hZytTD5iqY:sxEvYjVzANghwN
TLSH
T1A1A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-73-0x0000000071190000-0x00000000711DC000-memory.dmp

Download

memory/232-67-0x0000000006040000-0x0000000006397000-memory.dmp

Download

memory/232-74-0x00000000713E0000-0x0000000071737000-memory.dmp

Download

memory/1956-187-0x00000000710F0000-0x000000007113C000-memory.dmp

Download

memory/1956-188-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/1956-201-0x0000000007900000-0x0000000007911000-memory.dmp

Download

memory/1956-203-0x0000000006100000-0x0000000006115000-memory.dmp

Download

memory/2088-169-0x00000000710F0000-0x000000007113C000-memory.dmp

Download

memory/2088-170-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/2316-52-0x00000000713A0000-0x00000000716F7000-memory.dmp

Download

memory/2316-49-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/2316-61-0x0000000007B10000-0x0000000007B25000-memory.dmp

Download

memory/2316-60-0x0000000007AC0000-0x0000000007AD1000-memory.dmp

Download

memory/2316-59-0x00000000077C0000-0x0000000007864000-memory.dmp

Download

memory/2316-51-0x0000000071190000-0x00000000711DC000-memory.dmp

Download

memory/2316-50-0x0000000006AF0000-0x0000000006B3C000-memory.dmp

Download

memory/2440-210-0x00000000710F0000-0x000000007113C000-memory.dmp

Download

memory/2440-211-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/2488-114-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/2488-129-0x0000000007910000-0x0000000007921000-memory.dmp

Download

memory/2488-109-0x0000000005DB0000-0x0000000006107000-memory.dmp

Download

memory/2488-121-0x00000000075F0000-0x0000000007694000-memory.dmp

Download

memory/2488-111-0x0000000006550000-0x000000000659C000-memory.dmp

Download

memory/2488-113-0x00000000710F0000-0x000000007113C000-memory.dmp

Download

memory/2488-131-0x0000000006130000-0x0000000006145000-memory.dmp

Download

memory/2928-158-0x00000000710F0000-0x000000007113C000-memory.dmp

Download

memory/2928-160-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/2928-168-0x0000000006810000-0x0000000006825000-memory.dmp

Download

memory/3764-90-0x0000000071190000-0x00000000711DC000-memory.dmp

Download

memory/3764-88-0x0000000005C90000-0x0000000005FE7000-memory.dmp

Download

memory/3764-91-0x0000000071310000-0x0000000071667000-memory.dmp

Download

memory/4184-27-0x00000000030E0000-0x00000000030F0000-memory.dmp

Download

memory/4184-15-0x0000000006A30000-0x0000000006A7C000-memory.dmp

Download

memory/4184-39-0x00000000080D0000-0x00000000080EA000-memory.dmp

Download

memory/4184-38-0x0000000008080000-0x0000000008095000-memory.dmp

Download

memory/4184-37-0x0000000008070000-0x000000000807E000-memory.dmp

Download

memory/4184-36-0x0000000008020000-0x0000000008031000-memory.dmp

Download

memory/4184-35-0x0000000008110000-0x00000000081A6000-memory.dmp

Download

memory/4184-34-0x0000000008000000-0x000000000800A000-memory.dmp

Download

memory/4184-32-0x0000000008600000-0x0000000008C7A000-memory.dmp

Download

memory/4184-33-0x0000000007FC0000-0x0000000007FDA000-memory.dmp

Download

memory/4184-0-0x00000000030E0000-0x00000000030F0000-memory.dmp

Download

memory/4184-28-0x0000000007E70000-0x0000000007E8E000-memory.dmp

Download

memory/4184-1-0x0000000005560000-0x0000000005596000-memory.dmp

Download

memory/4184-2-0x00000000030E0000-0x00000000030F0000-memory.dmp

Download

memory/4184-3-0x0000000005BD0000-0x00000000061FA000-memory.dmp

Download

memory/4184-4-0x0000000005B50000-0x0000000005B72000-memory.dmp

Download

memory/4184-31-0x0000000007E90000-0x0000000007F34000-memory.dmp

Download

memory/4184-5-0x0000000006330000-0x0000000006396000-memory.dmp

Download

memory/4184-29-0x00000000030E0000-0x00000000030F0000-memory.dmp

Download

memory/4184-30-0x00000000030E0000-0x00000000030F0000-memory.dmp

Download

memory/4184-20-0x0000000071200000-0x0000000071557000-memory.dmp

Download

memory/4184-19-0x0000000071080000-0x00000000710CC000-memory.dmp

Download

memory/4184-18-0x0000000007E30000-0x0000000007E64000-memory.dmp

Download

memory/4184-17-0x000000007F0C0000-0x000000007F0D0000-memory.dmp

Download

memory/4184-16-0x0000000006F80000-0x0000000006FC6000-memory.dmp

Download

memory/4184-40-0x00000000080F0000-0x00000000080F8000-memory.dmp

Download

memory/4184-14-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Download

memory/4184-13-0x0000000006510000-0x0000000006867000-memory.dmp

Download

memory/4184-6-0x00000000064A0000-0x0000000006506000-memory.dmp

Download

memory/4188-218-0x00000000710F0000-0x000000007113C000-memory.dmp

Download

memory/4188-219-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/4416-151-0x00000000063B0000-0x00000000063C5000-memory.dmp

Download

memory/4416-142-0x0000000008040000-0x0000000008051000-memory.dmp

Download

memory/4416-134-0x0000000071A30000-0x0000000071D87000-memory.dmp

Download

memory/4416-141-0x0000000007E90000-0x0000000007F34000-memory.dmp

Download

memory/4416-133-0x00000000710F0000-0x000000007113C000-memory.dmp

Download