phemedrone | 1568c7c5a406c63d713a2822cad82b5284db8fd360463d450f1df78e31583d0b

General

Target
Everything.exe
Size 2.6MB
Sample260601-khjtsshv8j
SHA256 1568c7c5a406c63d713a2822cad82b5284db8fd360463d450f1df78e31583d0b
MD5 1cdf6dbdae7e55455803d4f2d99db88f
SHA1 5e092e22c73fcd040b0ccb23ac37f32b74eb7fe8
SHA512 dbc3bb6d534e6a7ca016640a404484ca2365b29c680171f32b57bdbd9fb32e07a52a9d2d574a5bf54ce71e0d47f4cb61658453be8c438f1698d0ab1e8da3dda2
SSDEEP 49152:eOtTYNl5fj1P/cJPDrZPM/Ns4BbnQAwsDNOUZHxOezRk1+gLTbhoLOE+uy+:eOtTYlj18JqYEnEMRk1+g/bamuy+
TLSH
T18DC52322B9908431DC5208741AE2B272E37CB9B85FE45FD7A7542F695F700E1DA38AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gtav credential_access discovery execution phemedrone sheetrat persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7273749260:AAEANE-FnbYPy61NoMvmkj5MOd00Ynl6h_g/sendDocument

Extracted

Family

sheetrat

Version

1.8

Campaign

GTAV

C2

ships-florist.gl.at.ply.gg:51965

Mutex

ydkmzmj(c(yjjtg7m_ya3b&!iwa*

Attributes

anti_virtual
false
certificate
u6146azqzwtn1i3lckj
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
2r29wm34ecfzx76v4d4b05ljpnhac
path_client
%Windows%\System32\xdwdDRkernel.exe
path_watch_dog
%Windows%\Scenarios\xdwdgrwMedia.exe
pump
true
rootkit
qqtjc5rmxdo
task_client
AppID\CrashReporter_NvTew
task_watch_dog
Maps\MachineCoreGoogleUpdateTor
use_install_admin
false
user_init
true

Signatures

Family: Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x0007000000024576-8.dat	family_sheetrat_v1
behavioral1/memory/956-26-0x00000000009C0000-0x0000000000A38000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDRkernel.exe"	Cheat.sfx.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3476	chrome.exe
4260	chrome.exe
2300	chrome.exe
3420	chrome.exe
4440	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Cheat.sfx.exe

Executes dropped EXE 2 IoCs

pid	Process
956	Cheat.sfx.exe
3700	tzidRecG.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\xdwdDRkernel.exe	Cheat.sfx.exe
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	Cheat.sfx.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Cheat.sfx.exe
File opened for modification	C:\Windows\xdwd.dll	Cheat.sfx.exe
File created	C:\Windows\Scenarios\xdwdgrwMedia.exe	Cheat.sfx.exe
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	Cheat.sfx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2420	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Cheat.sfx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3132	schtasks.exe
4556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3700	tzidRecG.exe
4260	chrome.exe
4260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	tzidRecG.exe
Token: SeDebugPrivilege	956	Cheat.sfx.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 956	4720	Everything.exe	88
PID 4720 wrote to memory of 3700	4720	Everything.exe	90
PID 3700 wrote to memory of 4260	3700	tzidRecG.exe	91
PID 4260 wrote to memory of 4112	4260	chrome.exe	92
PID 4260 wrote to memory of 4524	4260	chrome.exe	95
PID 4260 wrote to memory of 2420	4260	chrome.exe	96
PID 4260 wrote to memory of 4524	4260	chrome.exe	95
PID 4260 wrote to memory of 1192	4260	chrome.exe	97
PID 4260 wrote to memory of 1192	4260	chrome.exe	97
PID 4260 wrote to memory of 3420	4260	chrome.exe	98
PID 4260 wrote to memory of 2300	4260	chrome.exe	99
PID 4260 wrote to memory of 3420	4260	chrome.exe	98
PID 4260 wrote to memory of 2300	4260	chrome.exe	99
PID 4260 wrote to memory of 4440	4260	chrome.exe	100
PID 4260 wrote to memory of 4440	4260	chrome.exe	100
PID 4260 wrote to memory of 3476	4260	chrome.exe	101
PID 4260 wrote to memory of 3476	4260	chrome.exe	101
PID 956 wrote to memory of 1016	956	Cheat.sfx.exe	105
PID 956 wrote to memory of 700	956	Cheat.sfx.exe	106
PID 700 wrote to memory of 3132	700	cmd.exe	109
PID 956 wrote to memory of 3316	956	Cheat.sfx.exe	110
PID 3316 wrote to memory of 4556	3316	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Everything.exe
"C:\Users\Admin\AppData\Local\Temp\Everything.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="f<Lqh^3PhLYnhH" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit
    3⤵
    PID:1016
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4556
- - C:\Windows\System32\xdwdDRkernel.exe
    "C:\Windows\System32\xdwdDRkernel.exe"
    3⤵
    PID:3104
- C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe
  "C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff924f3c728,0x7ff924f3c734,0x7ff924f3c740
      4⤵
      PID:4112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,14962652106068985539,8937909514362896971,262144 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:4524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,11471578441370347831,13964870575238442057,524288 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      System Time Discovery
      PID:2420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,17885680783160487372,5865099268615431348,524288 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2472 /prefetch:8
      4⤵
      PID:1192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,13299871515204241964,6259596014999851512,2097152 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,14576913904659815218,13185831400225712725,2097152 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,12908303518519120306,17509147445327213354,2097152 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4348 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,13134789234459595683,15817474932462201404,2097152 --field-trial-handle=2032,i,13764020578152666314,3138453201535763921,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2996

C:\Windows\System32\xdwdDRkernel.exe
C:\Windows\System32\xdwdDRkernel.exe
1⤵
PID:5044

C:\Windows\Scenarios\xdwdgrwMedia.exe
C:\Windows\Scenarios\xdwdgrwMedia.exe
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Modify Authentication Process

1

T1556

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Authentication Process

Modify Registry

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Modify Authentication Process

1

T1556

Steal Web Session Cookie

1

T1539

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1dfe785dbf5a8ca79fee0436eb0ebf9296a71ce2de140b6c69bde1222c4c2281
MD5 338f7a11a8d07de104ceecf4bc19d5c2
SHA1 f01efc9ce66e7bd91308588989a392631be34768
SHA512 f9d2b723b7ca29fe797afe3f6eb61479b6bdb96708585e54003eb1f7ad1cd554125d245da39bc638fe119f73e8359bc6c0495036bc310e5a8aee9944679bbdfb
SSDEEP 1536:bpLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:7qfd7NtZL8cHQRZEQ6Sps3
TLSH
T144C30237ABC21F339D92CF64B9130FD667B644A99034D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ac9e826d7bfe28d72987ca1007a900e16d038a4ba1b8dfbd2dce8ebd0516e349
MD5 2dd528d3ec613a75b72b8e7d9eed3ac2
SHA1 1155d6636f38efaf3b067d5669c5fd67bb774625
SHA512 749fb7a80934653ccc81f80d70d335a851ff7eebfec3340303b12a731a06dec24a4e2f93bc013827ee3e8783ccf3e81f9c46c3be98b7bba01687768f1a546588
SSDEEP 1536:9kmyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjt:isqfd7NtZL8cHQRZEQ6SpsS
TLSH
T1A2C30237ABC61F339E93CB64B9130FD797B644A99034D301AAAD3BEB6C83591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cheat.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe
Size 464KB
SHA256 3648a5ac08fab7638df4f3ed12ccaff99b9bd53de91b543fbe4015d1705ebca1
MD5 98f3c0928f2e327605b329b47f00515f
SHA1 4f4b2453509ac19f0940f69e1087d312d5e8e61e
SHA512 d31f7de9b356fcd173338011493a87bc59e851112b58e7ab0385ed0d36179433c1b2e2c3d4d816f57984947f381951325ab92c5eb7e769c840030256c2fa915c
SSDEEP 6144:pcqLZyHgqrSyQFp54+CbIebd89sX0ChUp1hsf:G+AHPOZ6+3N6vUp1af
TLSH
T11AA43BB28BC31D73D8C2E2BB3F05019A9988A94325FD116B613DF66EC26D6585343E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzidRecG.exe

Path C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe
Size 138KB
SHA256 371190a4c343a0b01eff79bcad0bc647ee7b9c69112bb21d42724bce2957162c
MD5 01be7a167e099b9977dfe8165fdca0d9
SHA1 242805c2b79b88c630a82dd10a29365eeee64291
SHA512 4999416317047ea4101ecf61fa4eced6d8fcf337db9b1c1a64c58b67aaf313ea9b8d938055d16d4a24e95a03844dd81fe676e1ab9277573eab18d6f7ec819ca8
SSDEEP 1536:bcxA4IFzn6/VvFmaUo8xUYROosEUa4qw3/OVDviadWu0NV5a5Htdbpps9dnKelYj:bcx2bouad8xaoL4qw3/ugva571SKeqf
TLSH
T189D3191479EA0519D37F9AB5EFE8F4A58A65E1220E0BF7BA194216C21F52BC0FD03077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-26-0x00000000009C0000-0x0000000000A38000-memory.dmp

Download

memory/3700-27-0x000001F286E70000-0x000001F286E98000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads