glupteba | d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/05/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmprgo6xq4g.exe
Size 9.1MB
Sample260522-1vxjeshy4x
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit trojan

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000028513-101.dat	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\tmprgo6xq4g.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	tmprgo6xq4g.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
220	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2040	csrss.exe
4336	csrss.exe
3048	csrss.exe
2064	csrss.exe
3068	csrss.exe
2464	injector.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	tmprgo6xq4g.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\tmprgo6xq4g.exe = "0"	tmprgo6xq4g.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmprgo6xq4g.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmprgo6xq4g.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmprgo6xq4g.exe
File created	C:\Windows\rss\csrss.exe	tmprgo6xq4g.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe
1856	powershell.exe
4164	powershell.exe
4740	powershell.exe
4628	powershell.exe
1676	powershell.exe
1196	powershell.exe
4652	powershell.exe
4948	powershell.exe
2960	powershell.exe
4784	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmprgo6xq4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmprgo6xq4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4932	schtasks.exe
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1676	powershell.exe
1676	powershell.exe
1320	tmprgo6xq4g.exe
1320	tmprgo6xq4g.exe
4784	powershell.exe
4784	powershell.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
772	tmprgo6xq4g.exe
3420	powershell.exe
3420	powershell.exe
1196	powershell.exe
1196	powershell.exe
4652	powershell.exe
4652	powershell.exe
1856	powershell.exe
1856	powershell.exe
4948	powershell.exe
4948	powershell.exe
4336	csrss.exe
4336	csrss.exe
4164	powershell.exe
4164	powershell.exe
2960	powershell.exe
2960	powershell.exe
4740	powershell.exe
3048	csrss.exe
3048	csrss.exe
4740	powershell.exe
4628	powershell.exe
4628	powershell.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2040	csrss.exe
2040	csrss.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2040	csrss.exe
2040	csrss.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe
2464	injector.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe
Token: 34	1676	powershell.exe
Token: 35	1676	powershell.exe
Token: 36	1676	powershell.exe
Token: SeDebugPrivilege	1320	tmprgo6xq4g.exe
Token: SeImpersonatePrivilege	1320	tmprgo6xq4g.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3420	powershell.exe
Token: SeIncreaseQuotaPrivilege	3420	powershell.exe
Token: SeSecurityPrivilege	3420	powershell.exe
Token: SeTakeOwnershipPrivilege	3420	powershell.exe
Token: SeLoadDriverPrivilege	3420	powershell.exe
Token: SeSystemtimePrivilege	3420	powershell.exe
Token: SeBackupPrivilege	3420	powershell.exe
Token: SeRestorePrivilege	3420	powershell.exe
Token: SeShutdownPrivilege	3420	powershell.exe
Token: SeSystemEnvironmentPrivilege	3420	powershell.exe
Token: SeUndockPrivilege	3420	powershell.exe
Token: SeManageVolumePrivilege	3420	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1196	powershell.exe
Token: SeIncreaseQuotaPrivilege	1196	powershell.exe
Token: SeSecurityPrivilege	1196	powershell.exe
Token: SeTakeOwnershipPrivilege	1196	powershell.exe
Token: SeLoadDriverPrivilege	1196	powershell.exe
Token: SeSystemtimePrivilege	1196	powershell.exe
Token: SeBackupPrivilege	1196	powershell.exe
Token: SeRestorePrivilege	1196	powershell.exe
Token: SeShutdownPrivilege	1196	powershell.exe
Token: SeSystemEnvironmentPrivilege	1196	powershell.exe
Token: SeUndockPrivilege	1196	powershell.exe
Token: SeManageVolumePrivilege	1196	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1676	1320	tmprgo6xq4g.exe	84
PID 772 wrote to memory of 4784	772	tmprgo6xq4g.exe	118
PID 772 wrote to memory of 4668	772	tmprgo6xq4g.exe	92
PID 4668 wrote to memory of 220	4668	cmd.exe	94
PID 772 wrote to memory of 3420	772	tmprgo6xq4g.exe	95
PID 772 wrote to memory of 1196	772	tmprgo6xq4g.exe	97
PID 772 wrote to memory of 2040	772	tmprgo6xq4g.exe	99
PID 2040 wrote to memory of 4652	2040	csrss.exe	100
PID 4336 wrote to memory of 1856	4336	csrss.exe	104
PID 2040 wrote to memory of 4948	2040	csrss.exe	110
PID 3048 wrote to memory of 4164	3048	csrss.exe	120
PID 2064 wrote to memory of 2960	2064	csrss.exe	123
PID 2040 wrote to memory of 4740	2040	csrss.exe	125
PID 3068 wrote to memory of 4628	3068	csrss.exe	128
PID 2040 wrote to memory of 2464	2040	csrss.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe
"C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:220
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4652
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4988
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4948
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4932

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2960

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4784

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b0f9cae7ea248a3bc31f948a1efe46a49acce56c3070eb2585db17839175be64
MD5 0b756f791b67b0879780eccd91529209
SHA1 b4c1c7ccb86ffa90bfca9fd47b516f0768d55e0a
SHA512 5a41ba14b2cc60aa8d128b4134ffca56ddd5b00bf15798681eee25bd4fa3263f96430e11538b98aafaaca73500a09e5d5f075d4ace221edbbec74af7c92a6dd8
TLSH
T1C2416B303131B4D94D826F1215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 23KB
SHA256 d61fe918d3dc8504f5d46c0c0806819fab562bd792e7b3652c1b2048b232111b
MD5 079d7ccdc59dda1ff81cf3fed00efa93
SHA1 106db2fc44e7ac3646b3a9903410c2d1fd1b1aea
SHA512 c8cc30b01b1c019989021b063d2271e232ac5b52cb144001f12d0b4e293cb8a48f4c17215c342deeaec9732c936c2b74d2af14aef3848c50b2c88d3ced26b49c
SSDEEP 384:LtfQnQyaZ4N7IdVcs2C1sfR4gQ1t6uGZT8ChewYGbL2z/G2Kqivz5AZ69AlLDy32:BfsVkhn2C1Y6wuG98OeVGe/Kq2Nh2j
TLSH
T10DB2C72621FB4DE7DAC61070959A02FEFFE098409A3835CCEB2EE7586CD6D765270364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 23KB
SHA256 cacd25e8749ac1f42b0e743b59d91270f72f106656b4f5f5ccf98c2c6bdc9159
MD5 f9ec771688024f2562146e4a41227687
SHA1 6238ffc2bdc59aac1ee7a2a562abf66e0dc5ba12
SHA512 63b7dfb17866c59f15851f680254aa66d4c2c3f44c62eb16292874fcff889ee4e569d12c736b7359bb8789030e5d82c96f054e4a2e0b70b36353febf96b0eac3
SSDEEP 384:mhQnQO5KfTAdzA5cXqMC1gx4711PGH7W55sVdocT9BNKRi24tt5rcZje2+AQn:Qsx5K7ZMC1gx61GHyIVd7T5KRz+twYT
TLSH
T120B2191762A74EDFD9C620614489079AEFE0D811972166CEEB0FA7197C8BC3D65603F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3l2nfq0m.1zr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3l2nfq0m.1zr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b
MD5 f9349064c7c8f8467cc12d78a462e5f9
SHA1 5e1d27fc64751cd8c0e9448ee47741da588b3484
SHA512 3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf
TLSH
T1B2417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 cfe838443876e305acf13026d384ffef731e82836806354a925b3ab0e90469d3
MD5 583cf90ef8612208c8525ca52a1c0298
SHA1 df35102a9bb2d2619d5e38108d29a3b95866a578
SHA512 fd8045209ce45c6069e6039b242def6a1e339d72eac4c9178a22af70a17c7f3301372ec8453dd9a4bf69589cdc28b64c2a204bf77df07d1400b79facd0bd0b3b
SSDEEP 384:etfQD3HaGXFP6JcXqMC1g54eKXAFN8cJAk3q7tgGONJF30PC5yOzz2GKpn:OfgHT2MC1g5BpFN8cnq5gGwJFaCX0
TLSH
T10EA2092D25EB4CCECAC560B0498D4B99EFE4ED52A3B461CFE70EAA1E18C653C95100FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 8ba9e0e6b5d8db574503828b164d4b733ded659eb301e40dae17fd0ef4253a5a
MD5 8f28eddd9a43d1c1f7b934b0753af9eb
SHA1 bc5ced53e7119c5886bb3c38575d96eaa525a8d2
SHA512 d76297acc59a813c785f69262270b6b17d79323325eeeb5e97eb0edc44532d11db9cbdf9abaeeb59b5d4be6c21e01389f28f43454629c7ff007065aaf0b1168e
SSDEEP 384:vtfQDuaA2xWVLcVyqMrd4GUAFN88AkX1MvsuN5FNJP5yu82o5bn:VfFX2xfMrd5pFN8i1MvsQ5FDPyx
TLSH
T197A2F72921BB4DDEDAC520A1498947DAEFE4EC1167F422CEEB1EF61E18C693956100FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 3e3b8900c421f08845186f5b7895b574da6eea82fa0f7fd1fa7d6da246e3f293
MD5 95b8430c6f26c9df3558c083de3ec958
SHA1 17b52f666601d0791f01af0341370022cc1f9424
SHA512 eff074f510d3e2094fbc1487d3d2ea6a032f72ee66acf67824abf2a4d15f85d817bbc8d38aeb717159afbc6568d4b208a53453e474c82f7cb7e8bda5a1809da8
SSDEEP 384:84hQD33axnXMqMrJ4jDBFN8cJAkLq7hgGOJJiD0PC5y982GZsn:1g3axXMrJeFN8c7qFgGgJiuC9+
TLSH
T1F1A2F81D65EF8CDFC6C460A145898786DBE4ED1163B162CEEB1FBA0E18C693C9A501FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 5b63272be527a6881c4c44257fb1de66c6e6d7c55c4b36ba85b72e7518a05b43
MD5 858549dfecfc1faeb489e30c1cb19c2a
SHA1 1c8e8e492fd833cc91cd571363dca43bbbb2809e
SHA512 a2b89ec4d8c17ebf664a1d1a856582cefba18cf7873d9512da0d0912d8f3c02f3257d4ae42efb8cb75e80afc121bd663f540b1aad46bf7c3f15d5b5178e82749
SSDEEP 384:MtfQDuoTfOWFx5cs2rOKKXAFN8cJAkG7TPGOJJFpJP5yi82GDnn:kfFCfOWV2rfpFN8cWvPGgJFPPYb
TLSH
T10EA2091E26AB4CFFC98760A15989478DDFE4D95253F522CEE70FA91E188383D96600FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 892d52a64a8d2edc2a04cf8512d655d81c2f63c2c19568e18e15bb09e5885125
MD5 9e0c2a935cbbb1b552fa7f2a79c46b88
SHA1 7c7d59be9eff3bc9802ab41cf2d4ae9e14103f5f
SHA512 4ca1df9dd8d494902acffd55384e4b5c261ff347f50b1d2cfa727b9f42cf404a116f9c2222cb541f17656be63184b19739103a69530847f83a8cee68df3fbb80
SSDEEP 384:gtfQDOpuAqMrp4CU4JAkT1MzzGONFFFJP5yHrFxqGDbn:IfB2MrpNzD1MzzGwFF7POF
TLSH
T182A2191D36EB4CCEDAC560A09989478ADBE4DD1163B561CEEB4FBA0E5CC783C5A100EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 663de0a338691e1f2a2c3b2afc48fe0676141094daa878970539a050fae224f3
MD5 3316fbd16f28afbc0daed63fb5723e73
SHA1 8a7095b8076aad4ef19561afcccac9b5536f670d
SHA512 9d0d192c7be12a6bd425fc30925d0151e3cf571492a6757dfbed575eb72b6e0329228814920be9fb61da1a621a9fb019f45b6f365adcbd527cb3884fbec1c32e
SSDEEP 384:XtfQDuawp0pXh6qx9cs2C1sfZ48RpFN8cz1MXksdLCucaFdzV5xG4CNlHJNv:9fFdu52C1QzRpFN8m1MYaFhbx4
TLSH
T1DAA2D93520778DE9DAC115B0569D0AEEFFD1DC41ABB862CCEB2DFA1D4CD2D3A5620064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 3d8be518161885842fdb4d907306ffea3dce978c65e9ad9ea9fa4ec9d9dcad99
MD5 65536d43a328152a9d39b25c59f33184
SHA1 4816efd9fbe0a1503009fc96a9e92cf44dc50229
SHA512 8651ec0f92630f6a19331f50d8c5010ba128e884b1b524804ce9621d47f1499344fb11d13e31ee536815a4008e9e1f4b37387ba2aa340af7cac3f6904a230644
SSDEEP 384:xhQD3ja/fWgNv7mpinVcsCqMC1g94CIFN8cJAkTq7dgGONJiD0PC5yML2GZMn:fgjsjNjV9MC1g9NIFN8cDqxgGwJiuCpG
TLSH
T19AA2072925FB4CCECAC550B159894789DFE4ED1263B522CEE71FEA1E18C693D9A100FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-89-0x0000000071060000-0x00000000713B7000-memory.dmp

Download

memory/1196-88-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Download

memory/1676-16-0x0000000006290000-0x00000000062D4000-memory.dmp

Download

memory/1676-20-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Download

memory/1676-27-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/1676-25-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/1676-24-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/1676-36-0x00000000073C0000-0x00000000073CA000-memory.dmp

Download

memory/1676-23-0x0000000070D70000-0x00000000710C7000-memory.dmp

Download

memory/1676-21-0x0000000007260000-0x0000000007292000-memory.dmp

Download

memory/1676-37-0x0000000007470000-0x0000000007506000-memory.dmp

Download

memory/1676-35-0x00000000072E0000-0x0000000007383000-memory.dmp

Download

memory/1676-22-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

Download

memory/1676-34-0x00000000072C0000-0x00000000072DE000-memory.dmp

Download

memory/1676-19-0x00000000070B0000-0x00000000070CA000-memory.dmp

Download

memory/1676-18-0x0000000007710000-0x0000000007D8A000-memory.dmp

Download

memory/1676-17-0x0000000007010000-0x0000000007086000-memory.dmp

Download

memory/1676-15-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Download

memory/1676-14-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Download

memory/1676-0-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/1676-13-0x0000000005840000-0x0000000005B97000-memory.dmp

Download

memory/1676-4-0x0000000004F30000-0x0000000004F96000-memory.dmp

Download

memory/1676-5-0x00000000056D0000-0x0000000005736000-memory.dmp

Download

memory/1676-3-0x0000000004D90000-0x0000000004DB2000-memory.dmp

Download

memory/1676-2-0x0000000005000000-0x00000000056CA000-memory.dmp

Download

memory/1676-1-0x00000000022D0000-0x0000000002306000-memory.dmp

Download

memory/1856-142-0x0000000007400000-0x00000000074A3000-memory.dmp

Download

memory/1856-134-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/1856-133-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/2960-189-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/2960-190-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/3420-71-0x0000000071060000-0x00000000713B7000-memory.dmp

Download

memory/3420-70-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Download

memory/4164-179-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/4164-180-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/4628-226-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/4628-227-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/4652-102-0x00000000055A0000-0x00000000058F7000-memory.dmp

Download

memory/4652-113-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/4652-111-0x0000000006160000-0x00000000061AC000-memory.dmp

Download

memory/4652-115-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/4652-123-0x0000000006E70000-0x0000000006F13000-memory.dmp

Download

memory/4740-217-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/4740-218-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/4784-49-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Download

memory/4784-58-0x0000000007750000-0x00000000077F3000-memory.dmp

Download

memory/4784-50-0x0000000071060000-0x00000000713B7000-memory.dmp

Download

memory/4784-48-0x0000000006AA0000-0x0000000006AEC000-memory.dmp

Download

memory/4784-47-0x0000000005FA0000-0x00000000062F7000-memory.dmp

Download

memory/4948-154-0x0000000070FC0000-0x0000000071317000-memory.dmp

Download

memory/4948-163-0x00000000079B0000-0x0000000007A53000-memory.dmp

Download

memory/4948-153-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download