netwire | f3d3c6506e86445374ba7a46096b01020e63bbc22403a2007caf299e2f872455

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Size 1.4MB
Sample260601-chkr4ady6r
SHA256 f3d3c6506e86445374ba7a46096b01020e63bbc22403a2007caf299e2f872455
MD5 eb3b769c80c24d44107de40c288c2324
SHA1 8666bb49490388c1e9706ab5d2b6bff564a66a0c
SHA512 d9b9b6d804e9c607b08aafca9306abced602e02cb84102a1223b312e828eee5132a9d1b79f496743c26baefcaf743d6b1b425b05d716aca23e51ff9d494bebda
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYN:ho0c++OCokGs7Adgrd1f26RNYN
TLSH
T18C65BF52E39EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5EC3AAD21021112DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery execution netwire warzonerat infostealer persistence rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

NetWire RAT payload 26 IoCs

rat

resource	yara_rule
behavioral2/memory/4900-1-0x00000000003F0000-0x000000000055B000-memory.dmp	netwire
behavioral2/memory/4900-0-0x00000000003F0000-0x000000000055B000-memory.dmp	netwire
behavioral2/files/0x002600000002b345-6.dat	netwire
behavioral2/memory/3904-15-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3588-16-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4900-17-0x00000000003F0000-0x000000000055B000-memory.dmp	netwire
behavioral2/memory/3900-27-0x00000000003F0000-0x000000000055B000-memory.dmp	netwire
behavioral2/memory/4900-29-0x00000000003F0000-0x000000000055B000-memory.dmp	netwire
behavioral2/memory/2840-33-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/files/0x001900000002b53a-32.dat	netwire
behavioral2/memory/2840-34-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/1736-52-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/2840-53-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/3588-56-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3588-58-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4812-59-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2384-63-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/2384-74-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/3920-79-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4812-94-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/5380-95-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/5380-106-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/5480-112-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3996-132-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/3996-133-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire
behavioral2/memory/3996-145-0x00000000005F0000-0x000000000075B000-memory.dmp	netwire

Warzone RAT payload 6 IoCs

rat

resource	yara_rule
behavioral2/memory/3900-18-0x0000000001630000-0x000000000164D000-memory.dmp	warzonerat
behavioral2/memory/3900-26-0x0000000001630000-0x000000000164D000-memory.dmp	warzonerat
behavioral2/memory/1736-43-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/1736-51-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/5440-97-0x0000000000460000-0x000000000047D000-memory.dmp	warzonerat
behavioral2/memory/5440-105-0x0000000000460000-0x000000000047D000-memory.dmp	warzonerat

Executes dropped EXE 14 IoCs

pid	Process
3904	Blasthost.exe
3588	Host.exe
2840	RtDCpl64.exe
4812	Blasthost.exe
1736	RtDCpl64.exe
2384	RtDCpl64.exe
3920	Blasthost.exe
5176	RtDCpl64.exe
5380	RtDCpl64.exe
5480	Blasthost.exe
5440	RtDCpl64.exe
3996	RtDCpl64.exe
1984	Blasthost.exe
5868	RtDCpl64.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4900-1-0x00000000003F0000-0x000000000055B000-memory.dmp	autoit_exe
behavioral2/memory/4900-0-0x00000000003F0000-0x000000000055B000-memory.dmp	autoit_exe
behavioral2/memory/4900-17-0x00000000003F0000-0x000000000055B000-memory.dmp	autoit_exe
behavioral2/memory/3900-27-0x00000000003F0000-0x000000000055B000-memory.dmp	autoit_exe
behavioral2/memory/4900-29-0x00000000003F0000-0x000000000055B000-memory.dmp	autoit_exe
behavioral2/memory/2840-33-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/files/0x001900000002b53a-32.dat	autoit_exe
behavioral2/memory/2840-34-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/1736-52-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/2840-53-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/2384-63-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/2384-74-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/5380-95-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/5380-106-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/3996-132-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/3996-133-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe
behavioral2/memory/3996-145-0x00000000005F0000-0x000000000075B000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4900 set thread context of 3900	4900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	82
PID 2840 set thread context of 1736	2840	RtDCpl64.exe	90
PID 2384 set thread context of 5176	2384	RtDCpl64.exe	97
PID 5380 set thread context of 5440	5380	RtDCpl64.exe	104
PID 3996 set thread context of 5868	3996	RtDCpl64.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blasthost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2140	schtasks.exe
1384	schtasks.exe
5552	schtasks.exe
1544	schtasks.exe
1676	schtasks.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3904	4900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	80
PID 3904 wrote to memory of 3588	3904	Blasthost.exe	81
PID 4900 wrote to memory of 3900	4900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	82
PID 4900 wrote to memory of 3900	4900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	82
PID 3900 wrote to memory of 4564	3900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	83
PID 4900 wrote to memory of 1676	4900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	85
PID 3900 wrote to memory of 4564	3900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	83
PID 3900 wrote to memory of 4564	3900	2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	83
PID 2840 wrote to memory of 4812	2840	RtDCpl64.exe	89
PID 2840 wrote to memory of 1736	2840	RtDCpl64.exe	90
PID 2840 wrote to memory of 1736	2840	RtDCpl64.exe	90
PID 1736 wrote to memory of 1400	1736	RtDCpl64.exe	91
PID 2840 wrote to memory of 2140	2840	RtDCpl64.exe	93
PID 1736 wrote to memory of 1400	1736	RtDCpl64.exe	91
PID 1736 wrote to memory of 1400	1736	RtDCpl64.exe	91
PID 2384 wrote to memory of 3920	2384	RtDCpl64.exe	96
PID 2384 wrote to memory of 5176	2384	RtDCpl64.exe	97
PID 2384 wrote to memory of 5176	2384	RtDCpl64.exe	97
PID 5176 wrote to memory of 4188	5176	RtDCpl64.exe	98
PID 2384 wrote to memory of 1384	2384	RtDCpl64.exe	100
PID 5176 wrote to memory of 4188	5176	RtDCpl64.exe	98
PID 5176 wrote to memory of 4188	5176	RtDCpl64.exe	98
PID 5380 wrote to memory of 5480	5380	RtDCpl64.exe	103
PID 5380 wrote to memory of 5440	5380	RtDCpl64.exe	104
PID 5380 wrote to memory of 5440	5380	RtDCpl64.exe	104
PID 5440 wrote to memory of 5512	5440	RtDCpl64.exe	105
PID 5380 wrote to memory of 5552	5380	RtDCpl64.exe	107
PID 5440 wrote to memory of 5512	5440	RtDCpl64.exe	105
PID 5440 wrote to memory of 5512	5440	RtDCpl64.exe	105
PID 3996 wrote to memory of 1984	3996	RtDCpl64.exe	110
PID 3996 wrote to memory of 5868	3996	RtDCpl64.exe	111
PID 3996 wrote to memory of 5868	3996	RtDCpl64.exe	111
PID 5868 wrote to memory of 936	5868	RtDCpl64.exe	112
PID 3996 wrote to memory of 1544	3996	RtDCpl64.exe	114
PID 5868 wrote to memory of 936	5868	RtDCpl64.exe	112
PID 5868 wrote to memory of 936	5868	RtDCpl64.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3588
- C:\Users\Admin\AppData\Local\Temp\2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-01_eb3b769c80c24d44107de40c288c2324_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1676

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1400
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2140

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1384

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5512
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5552

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Blasthost.exe

Path C:\Users\Admin\AppData\Roaming\Blasthost.exe
Size 132KB
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
SSDEEP 1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rwc5ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3rvZG
TLSH
T1E9D3A419E66BD0F9FD472C7480DFF26F46386D00C534CF62DF953E02DA27921A129AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.4MB
SHA256 a9d27ec2c27310fb7eb7c31eff6be8756b0944b91c149b700ec684a75ed33fa5
MD5 aa78d965c93a07ee503555a6528d461d
SHA1 d6b1a852fa1434c3d250708c5956425b85de3fc6
SHA512 50d7feb5c811f17207609089b3c0d3058b95b4fdbeb3089ffc8945ca6bb8330225bb6d456b2a4295f14fb46e6c8edb90319d940740dfa6ee27dd09e507dbcfe2
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYG:ho0c++OCokGs7Adgrd1f26RNYG
TLSH
T14165BF52E39EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5EC3AAD21021112DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-148-0x0000000001410000-0x0000000001411000-memory.dmp

Download

memory/1400-54-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/1736-43-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1736-52-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/1736-51-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2384-74-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/2384-63-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/2840-53-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/2840-33-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/2840-34-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/3588-56-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3588-58-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3588-16-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3900-27-0x00000000003F0000-0x000000000055B000-memory.dmp

Download

memory/3900-26-0x0000000001630000-0x000000000164D000-memory.dmp

Download

memory/3900-18-0x0000000001630000-0x000000000164D000-memory.dmp

Download

memory/3904-15-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3904-11-0x0000000000429000-0x000000000042A000-memory.dmp

Download

memory/3920-79-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3996-132-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/3996-145-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/3996-133-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/4188-75-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/4564-30-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/4812-59-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4812-94-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4900-17-0x00000000003F0000-0x000000000055B000-memory.dmp

Download

memory/4900-1-0x00000000003F0000-0x000000000055B000-memory.dmp

Download

memory/4900-29-0x00000000003F0000-0x000000000055B000-memory.dmp

Download

memory/4900-0-0x00000000003F0000-0x000000000055B000-memory.dmp

Download

memory/5380-106-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/5380-95-0x00000000005F0000-0x000000000075B000-memory.dmp

Download

memory/5440-97-0x0000000000460000-0x000000000047D000-memory.dmp

Download

memory/5440-105-0x0000000000460000-0x000000000047D000-memory.dmp

Download

memory/5480-112-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5512-108-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads