glupteba | d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmprgo6xq4g.exe
Size 9.1MB
Sample260522-1vxjeshy4x
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit spyware trojan

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000242d1-109.dat	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3188	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2528	csrss.exe
3248	csrss.exe
3012	csrss.exe
1824	csrss.exe
3944	csrss.exe
3108	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmprgo6xq4g.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
78	raw.githubusercontent.com
79	raw.githubusercontent.com

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmprgo6xq4g.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmprgo6xq4g.exe
File created	C:\Windows\rss\csrss.exe	tmprgo6xq4g.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1300	powershell.exe
3108	powershell.exe
4500	powershell.exe
2636	powershell.exe
792	powershell.exe
2548	powershell.exe
3892	powershell.exe
4984	powershell.exe
652	powershell.exe
3108	powershell.exe
4488	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmprgo6xq4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmprgo6xq4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	csrss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1688	schtasks.exe
3000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
652	powershell.exe
652	powershell.exe
3484	tmprgo6xq4g.exe
3484	tmprgo6xq4g.exe
792	powershell.exe
792	powershell.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
1984	tmprgo6xq4g.exe
3108	powershell.exe
3108	powershell.exe
2548	powershell.exe
2548	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
3108	powershell.exe
3108	powershell.exe
3248	csrss.exe
3248	csrss.exe
3108	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4984	powershell.exe
4984	powershell.exe
4984	powershell.exe
1824	csrss.exe
1824	csrss.exe
2636	powershell.exe
2636	powershell.exe
2636	powershell.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
2528	csrss.exe
2528	csrss.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
3108	injector.exe
2528	csrss.exe
2528	csrss.exe
3108	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	3484	tmprgo6xq4g.exe
Token: SeImpersonatePrivilege	3484	tmprgo6xq4g.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	3248	csrss.exe
Token: SeImpersonatePrivilege	3248	csrss.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	1824	csrss.exe
Token: SeImpersonatePrivilege	1824	csrss.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeSystemEnvironmentPrivilege	2528	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 652	3484	tmprgo6xq4g.exe	90
PID 1984 wrote to memory of 792	1984	tmprgo6xq4g.exe	95
PID 1984 wrote to memory of 1340	1984	tmprgo6xq4g.exe	100
PID 1340 wrote to memory of 3188	1340	cmd.exe	102
PID 1984 wrote to memory of 3108	1984	tmprgo6xq4g.exe	141
PID 1984 wrote to memory of 2548	1984	tmprgo6xq4g.exe	105
PID 1984 wrote to memory of 2528	1984	tmprgo6xq4g.exe	108
PID 2528 wrote to memory of 4488	2528	csrss.exe	109
PID 3248 wrote to memory of 1300	3248	csrss.exe	136
PID 2528 wrote to memory of 3108	2528	csrss.exe	141
PID 3012 wrote to memory of 3892	3012	csrss.exe	131
PID 1824 wrote to memory of 4500	1824	csrss.exe	148
PID 2528 wrote to memory of 4984	2528	csrss.exe	135
PID 3944 wrote to memory of 2636	3944	csrss.exe	138
PID 2528 wrote to memory of 3108	2528	csrss.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe
"C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprgo6xq4g.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3188
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4488
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1688
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4984
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3108
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3000

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3892

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2636

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv X4L3x8n70EWmOo0vvVXCsA.0.2
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 9e1eb377fdd3085e479998cf92dac9ead8477f10daeaad137d28dac2bee7a2d4
MD5 3dbf30951c3cb350f96a34e0e1e0e4d4
SHA1 0e113ae0879e880e17fcd5dcfc91da4845cdbc3d
SHA512 73cf50a5c5c213bcbf87fd725fbfc4b737d891a3c99fd9ee599e1eb126aefaa0c51a187e8ab9437da9ab6e4790e36e765e2701071cc72a56dc0d5f3abad4c27b
SSDEEP 384:3sf+hoJ9i+6cuL8wMhCZBxTYIXw1o9stUEXK6seYbneqx/xofLYbLU0yF5Xt9KyT:cfAAuL8IXbhstUEXN+nFQY/X4Xt9CzO3
TLSH
T124A2D65E618F1AC3C4866378D10A041FE8F2DE8D431926D8BB1F9F778A6C6BE6178548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 4dc2ef0e795662d427642e7e68e113437a7a0e1809d59da28b784b235ff50202
MD5 bc39295eca19e491ce3ed6abc003fec5
SHA1 458d5814ae4b4ef82d3bce86b275df98acbca09c
SHA512 a184853157468035b3353d37131c34d8cd8c18beae4d286880bf9d33e8d360b4a7103466875e0f2506b1d907c79684fcd8d45b4049fdae00bd38fd4263fd1545
SSDEEP 384:wsf+hoH91tLHj+QbFt3oCJkyto9o5PZNYFFNpfemTP/xUnsX0MoUIKg5k1KMWKW8:9fAItLHjHY3jo5PZN8FNpflPusaUBEq3
TLSH
T1C5A2291E621F2AD7D0A913B4C42643DBE5F08DCEC3801ADC774A593B46CEA7664E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_es1htj20.klr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_es1htj20.klr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e76920be1528d508f54cad442ca85f04aa4ff20fc5f5ec50d04fe79eb913b4f2
MD5 e28da94fab883201e7a73bfcd3de98a0
SHA1 fd80a169a468846542411f983fdc03d7ea979777
SHA512 1c271d9a9320ad6e5b2502793464dce7dfc85d3c7b6698ceaccf38b569c2619b3005a68e89248b355f84d978affdae76933e5cc3369320fb0c0feed4181f9d9f
SSDEEP 384:qsf+Bm9RBmrtm+VJviQkyto9odyRNYFFjffemFc7/IOfc1YdJC1ELQ+nFbOuj3l7:XfJmrArjodyRN8Fjffo75cE01u4ubl7
TLSH
T19292085D622F3A97D06612F0D42B4BEBEC709CCFC34406DE67855E3706CA7B588A81E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 229cb094c23a222ac85cc26acdf6765cc856e33f496b9d2190a5e33a26e72259
MD5 93fe276b7d5a1fbbf1d5b86c0bf285c8
SHA1 9c42339977cd260abb47a8f4a51e2d781fa5299a
SHA512 a165dcc5d00c10de1d5c7abb5396d3dee95755e9082a8791f2be3ce048ec821fe159d56a451f430eb7b5a4043ad5a43069e901f5434a23c342ece4e042eba30a
SSDEEP 384:36+BHRBgs8ZBij4k+o9o5UKYYFFNpfN1w7/IOMcmaMloEd1Rjxq+nFbOuj3lu3hV:q0gZoHjo5UN8FNpf87FVUj1R54ublQ
TLSH
T1DC92175D622F2A97C46923F4E42643DFD5B0ADCF838006DD67845E3B06CA6B684ED1F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 731b373aa98794369c2c7acbff84f5507672e2670d89b35f96ae29cd674da8a4
MD5 43551456f70ee13f67537ba457fc85c2
SHA1 92380efda49338561047611e89ed115b5d2c77f6
SHA512 b0fbc862d692f553fe6692fc45216977c6ee5764ea9292d88057463646bfe18ef74b1c16aa22e65aadc5e148edcc49b560482325d9157821768532783fe2d1d7
SSDEEP 384:E8sf+BnRB9HR7fYBFzEnRNYFFNpfem1c7/ZKPMldy1Pr/+nFbOuj3lf0Og:E5fU9H5QCRN8FNpfY7SUo1a4ubls
TLSH
T16A92295D221F2AE6E0A113B4C42A47DBF9B09DCEC3400ADD978A6D3B06DA77644D90ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 dc724513ebf9db7c565275d06b695dc4cda341daa95d77e59782f707d03044b2
MD5 bbf21cbb16d59acc881cfa47bbda4170
SHA1 4fd997a3719b31768507143412b1866af8fe39f8
SHA512 c177e44bfed1d0bed109a50d2e37d17bda3d3528882aac11ae08c036c63ec5cbe800ccb1e8414568d0fb231ab61a04607d37b5152e2a29b7f89df3425d44297c
SSDEEP 384:06+BHRBbowuIipqYJkY9o9o568FNpfNRw7/IOuaMtoIc1SR+nFbOuj3lu0Og:VEboJoZho568FNpfA7Tc21l4ublb
TLSH
T19C92089E621F2A97C06613B4E02747EFE9B0ADCF830407DD67845E3706CA775C4A96E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 19c26e3edf51cd206460174dab2aef3e545fb9a2d2a9294db068170e842f69ac
MD5 c8851d5ac5c7e3461f4b16d3129cc4eb
SHA1 af29fee4991bafd53fa278a4c164b2c369691f4b
SHA512 389a6fd9078402c68f2e5c8c00e35be612b03cdc500742a5e14d919bdfc507317f7d4eeb50330c015e96412557535999fe5d92d07743887ecc518580f312a285
SSDEEP 384:p6+BB9m+vsNPdUXWz6Bikrmo9o2TVK6seYbneS8v/ZRwM0lOKEIjaiMZbObTUSH2:olBARokXo2TVN+nIvkOKEIyqMs2
TLSH
T10392D65E611F16C3C48503B8D11B045FE8F2EE8D531A17D8AB1E9F3B8EACA9E913D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 20369596af0beff64bfa0250775545106cd257ff1d9de1673df04cbab358a50a
MD5 9011886a514d330ea8de135e8c3d295e
SHA1 b1f586784c89390f26f79b52a6c09db86155b643
SHA512 5c79cbe434291c634f020a3aa3b7ceb9676b48b9bff4011372c9a6a05da43b55a04a829febc11defb4dd71b0162d54b88e5f8da7eb936a49164060023711224f
SSDEEP 384:Rsf+BW9RBOAUtExkSA9Wk3AVoU9KYYFFjffemxwUOscmPM1Je71Eo+nFbOuj3luH:Wf5OA7KSyVooU9N8FjffwpUk071a4ubC
TLSH
T11D92185D622F2AA3C4A513F4D42A03DBE8B09DCFC38406DD67891E3706DA77684E91F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9.1MB
SHA256 d787ebd2a6568778e6715f1cd0f28ef46dd5f2e81ecd67347ab4f667d12605a1
MD5 74ea3528711206c313711f523311365b
SHA1 4c8246ee00627b5387b7220d4e5a9c84b3caf65f
SHA512 e34bcdb5b7e8417559204c276dcec1b6c748f6507e0601d643b0bb2132a547064b8d775acbf3e011e2866e911130c718241c19b49cafb0fdbc11560951aa6da3
SSDEEP 98304:GHxMZDJ1TRpxYVX9u2IazANf6hZytTD5iq6j:sxEvYjVzANihwN4
TLSH
T157A66B91FA9B00F5EA13543084A7623F9331BD064B25CFCBD6506F2AED73AD20E36659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-18-0x00000000076B0000-0x0000000007D2A000-memory.dmp

Download

memory/652-0-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/652-22-0x00000000701C0000-0x000000007020C000-memory.dmp

Download

memory/652-21-0x00000000071D0000-0x0000000007202000-memory.dmp

Download

memory/652-34-0x0000000007230000-0x00000000072D3000-memory.dmp

Download

memory/652-33-0x0000000007210000-0x000000000722E000-memory.dmp

Download

memory/652-35-0x0000000007320000-0x000000000732A000-memory.dmp

Download

memory/652-25-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/652-36-0x0000000007430000-0x00000000074C6000-memory.dmp

Download

memory/652-24-0x0000000004780000-0x0000000004790000-memory.dmp

Download

memory/652-23-0x0000000070340000-0x0000000070694000-memory.dmp

Download

memory/652-37-0x0000000007330000-0x0000000007341000-memory.dmp

Download

memory/652-38-0x0000000007370000-0x000000000737E000-memory.dmp

Download

memory/652-39-0x0000000007390000-0x00000000073A4000-memory.dmp

Download

memory/652-41-0x00000000073D0000-0x00000000073D8000-memory.dmp

Download

memory/652-40-0x00000000073E0000-0x00000000073FA000-memory.dmp

Download

memory/652-1-0x0000000004670000-0x00000000046A6000-memory.dmp

Download

memory/652-2-0x0000000004DC0000-0x00000000053E8000-memory.dmp

Download

memory/652-3-0x0000000004D90000-0x0000000004DB2000-memory.dmp

Download

memory/652-5-0x00000000054D0000-0x0000000005536000-memory.dmp

Download

memory/652-4-0x0000000005460000-0x00000000054C6000-memory.dmp

Download

memory/652-13-0x0000000005630000-0x0000000005984000-memory.dmp

Download

memory/652-20-0x000000007F4F0000-0x000000007F500000-memory.dmp

Download

memory/652-19-0x0000000006F90000-0x0000000006FAA000-memory.dmp

Download

memory/652-17-0x0000000006FB0000-0x0000000007026000-memory.dmp

Download

memory/652-16-0x00000000061A0000-0x00000000061E4000-memory.dmp

Download

memory/652-15-0x0000000005D00000-0x0000000005D4C000-memory.dmp

Download

memory/652-14-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Download

memory/792-64-0x0000000007E50000-0x0000000007E64000-memory.dmp

Download

memory/792-63-0x0000000007E00000-0x0000000007E11000-memory.dmp

Download

memory/792-54-0x0000000070450000-0x00000000707A4000-memory.dmp

Download

memory/792-62-0x0000000007AE0000-0x0000000007B83000-memory.dmp

Download

memory/792-53-0x00000000702C0000-0x000000007030C000-memory.dmp

Download

memory/792-52-0x0000000006E80000-0x0000000006ECC000-memory.dmp

Download

memory/792-51-0x0000000006260000-0x00000000065B4000-memory.dmp

Download

memory/1300-153-0x0000000006560000-0x0000000006574000-memory.dmp

Download

memory/1300-152-0x0000000007E40000-0x0000000007E51000-memory.dmp

Download

memory/1300-142-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/1300-143-0x00000000709D0000-0x0000000070D24000-memory.dmp

Download

memory/2548-94-0x0000000006310000-0x0000000006664000-memory.dmp

Download

memory/2548-96-0x00000000702C0000-0x000000007030C000-memory.dmp

Download

memory/2548-97-0x0000000070D10000-0x0000000071064000-memory.dmp

Download

memory/2636-261-0x0000000006860000-0x0000000006874000-memory.dmp

Download

memory/2636-255-0x0000000008010000-0x0000000008021000-memory.dmp

Download

memory/2636-245-0x0000000070050000-0x000000007009C000-memory.dmp

Download

memory/2636-246-0x00000000709C0000-0x0000000070D14000-memory.dmp

Download

memory/2636-254-0x0000000007C90000-0x0000000007D33000-memory.dmp

Download

memory/2636-244-0x0000000006E30000-0x0000000006E7C000-memory.dmp

Download

memory/3108-78-0x0000000070A80000-0x0000000070DD4000-memory.dmp

Download

memory/3108-77-0x00000000702C0000-0x000000007030C000-memory.dmp

Download

memory/3108-174-0x00000000709C0000-0x0000000070D14000-memory.dmp

Download

memory/3108-173-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/3108-183-0x0000000007310000-0x0000000007321000-memory.dmp

Download

memory/3108-75-0x0000000005DB0000-0x0000000006104000-memory.dmp

Download

memory/3108-200-0x0000000005B60000-0x0000000005B74000-memory.dmp

Download

memory/3108-182-0x0000000006FA0000-0x0000000007043000-memory.dmp

Download

memory/3108-162-0x0000000005680000-0x00000000059D4000-memory.dmp

Download

memory/3892-211-0x0000000006400000-0x0000000006414000-memory.dmp

Download

memory/3892-185-0x00000000709C0000-0x0000000070D14000-memory.dmp

Download

memory/3892-203-0x0000000007E20000-0x0000000007E31000-memory.dmp

Download

memory/3892-184-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/4488-139-0x0000000007B60000-0x0000000007C03000-memory.dmp

Download

memory/4488-140-0x0000000006690000-0x00000000066A1000-memory.dmp

Download

memory/4488-141-0x00000000066D0000-0x00000000066E4000-memory.dmp

Download

memory/4488-130-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/4488-117-0x0000000006330000-0x0000000006684000-memory.dmp

Download

memory/4488-119-0x0000000006EA0000-0x0000000006EEC000-memory.dmp

Download

memory/4488-131-0x00000000709D0000-0x0000000070D24000-memory.dmp

Download

memory/4500-214-0x00000000709C0000-0x0000000070D14000-memory.dmp

Download

memory/4500-213-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/4984-222-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/4984-223-0x00000000709C0000-0x0000000070D14000-memory.dmp

Download