netwire | 91736aebc292f7aa6a99944d7a217b86616f5dbd86d7505a9dc0e567c508bf5d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpittliutd.exe
Size 1.2MB
Sample260601-ywf7qaev8x
SHA256 91736aebc292f7aa6a99944d7a217b86616f5dbd86d7505a9dc0e567c508bf5d
MD5 28c7c3357fdbfef80f92ff8d0efd5988
SHA1 be02669f64bb74b8de0492ef306ad395439c5037
SHA512 57b65b4af21cbcc72e3c8c0b18ed7d2531bf5c31e02642bd297f5e456befd87f10b670cbfa8ba2ea1f8cea2902eb4e141328284d3b763d07ca77edf42c9df5ad
SSDEEP 24576:SvpG2Cojx0pB9w/4Bf1ZXgcPDZuRW3Ane7AxFzEhed1r9:r2bx60/4B3NDcAwe7y+heR
TLSH
T10F45338F6F35EC91F6F385794FDDA341B4FDA5A16755B8020A28506CE0A1C23A6FF818
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion discovery netwire persistence rat spyware stealer trojan

Malware Config

Extracted

Family

netwire

pd1n.ddns.net:1968

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
pd1n-noip
lock_executable
false
offline_keylogger
false
password
Kimbolsapoq!P12
registry_autorun
false
use_mutex
false

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2548-32-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/2548-35-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/2548-40-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/4328-48-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Executes dropped EXE 2 IoCs

pid	Process
4296	sdfgdwscvb.exe
2832	sdfgdwscvb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfgyhtyswq = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\dfgyhtyswq.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfgyhtyswq = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\dfgyhtyswq.txt \| cmd"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4296 set thread context of 2548	4296	sdfgdwscvb.exe	106
PID 2832 set thread context of 4328	2832	sdfgdwscvb.exe	115

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.net\Framework\v2.0.50727\.IgHiJkLiO	regasm.exe
File opened for modification	C:\Windows\Microsoft.net\Framework\v2.0.50727\.IgHiJkLiO	regasm.exe
File opened for modification	C:\Windows\Microsoft.net\Framework\v2.0.50727\.IgHiJkLiO	regasm.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdfgdwscvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdfgdwscvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpittliutd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	tmpittliutd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	tmpittliutd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	tmpittliutd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	tmpittliutd.exe
Token: SeDebugPrivilege	4296	sdfgdwscvb.exe
Token: SeDebugPrivilege	2832	sdfgdwscvb.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4068	4192	tmpittliutd.exe	97
PID 4068 wrote to memory of 4296	4068	cmd.exe	99
PID 4296 wrote to memory of 4628	4296	sdfgdwscvb.exe	100
PID 4628 wrote to memory of 4460	4628	cmd.exe	102
PID 4296 wrote to memory of 3008	4296	sdfgdwscvb.exe	103
PID 4296 wrote to memory of 2892	4296	sdfgdwscvb.exe	104
PID 4296 wrote to memory of 4500	4296	sdfgdwscvb.exe	105
PID 4296 wrote to memory of 2548	4296	sdfgdwscvb.exe	106
PID 4296 wrote to memory of 2548	4296	sdfgdwscvb.exe	106
PID 4296 wrote to memory of 2548	4296	sdfgdwscvb.exe	106
PID 4296 wrote to memory of 2548	4296	sdfgdwscvb.exe	106
PID 4296 wrote to memory of 2548	4296	sdfgdwscvb.exe	106
PID 4740 wrote to memory of 4432	4740	cmd.exe	109
PID 4740 wrote to memory of 4888	4740	cmd.exe	110
PID 4888 wrote to memory of 2832	4888	cmd.exe	111
PID 2832 wrote to memory of 1036	2832	sdfgdwscvb.exe	112
PID 1036 wrote to memory of 4928	1036	cmd.exe	114
PID 2832 wrote to memory of 4328	2832	sdfgdwscvb.exe	115
PID 2832 wrote to memory of 4328	2832	sdfgdwscvb.exe	115
PID 2832 wrote to memory of 4328	2832	sdfgdwscvb.exe	115
PID 2832 wrote to memory of 4328	2832	sdfgdwscvb.exe	115
PID 2832 wrote to memory of 4328	2832	sdfgdwscvb.exe	115

C:\Users\Admin\AppData\Local\Temp\tmpittliutd.exe
"C:\Users\Admin\AppData\Local\Temp\tmpittliutd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe
    "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "dfgyhtyswq" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\dfgyhtyswq.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4460
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
      4⤵
      PID:3008
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
      4⤵
      PID:2892
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
      4⤵
      PID:4500
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2548

C:\Windows\system32\cmd.exe
"cmd /c type C:\Users\Admin\AppData\Local\Temp\dfgyhtyswq.txt | cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\dfgyhtyswq.txt "
  2⤵
  PID:4432
- C:\Windows\system32\cmd.exe
  cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe
    "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "dfgyhtyswq" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\dfgyhtyswq.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4928
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D0AC26322348780E90E022EA217C58C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3D0AC26322348780E90E022EA217C58C
Size 15KB
SHA256 63411a65519c3de55300e56fdf57f5094ca2e5a4589ae68d22cded895efed53d
MD5 e0e257038ba01c71de6e6d0c6462f414
SHA1 4e30ef0ec4d4951cce7147d39b014eca94d0e073
SHA512 99ffe44b970d17d38f1d1408cde14ea4b15c21012d3f8249a19cc61b759c0472b21ecfe3428ec98e849446329240dcd0eb3732bda7e1020b233bc5aff64a3114
SSDEEP 384:Q4+M+9/LHxv3f8XpZpY4DUQIcsAu88/XrK:xR8/Fv3E5I4YHAX
TLSH
T1F7621EDC9C6939D7B045A2B1C98B5EEBCD72B18533D2840AD5A55F014522FCE9EE80F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

A3D5BF1283C2E63D8C8A8C72F0051F5A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A
Size 834B
SHA256 de6bcf84b3f5959cfdf2f8b6622a68cbbbd52d804e59751a5e52a8ac985d369d
MD5 4ae5d026e246530e8e5c389ad0814e17
SHA1 e1c1a7225cac5fafcbb8bd8abf30559d2029914c
SHA512 1d0139cf1270f44e1d0fcc8d9eca365fbb86bb3bcd0993904c02b581a20f51aeb14d1de32a9224337f35a2c61667e791bf3a965d34633a5905526e986f772170
TLSH
T1740112E6C1187921A4915725C19CFD5FC87473C95FC9D44A90F8C7CA2C63F986B4206B
MD5 SHA1 SHA512 TLSH

Submit Download

3D0AC26322348780E90E022EA217C58C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
Size 170B
SHA256 74ebcf457c9a7afe8cf9785e2f846f57487329b13a58db073e37d16c421449a1
MD5 0ac2ed1ae99b7ba93518c17dd56ed79a
SHA1 cb9c8414c390f7188b61297ba720862e6f76fed9
SHA512 dea1c39a2568d71395029a85f46c6faf1520535bb6c76a38ee81f4646d5b288a07671a87d9e0f70e891c4329823bcf8af3744cd87abc494de201fb1d08719f95
TLSH
T165C02B8507444386F011AC3F40631F22AF150400CCB1C7C2067A130C0C0471449F3800
MD5 SHA1 SHA512 TLSH

Submit Download

8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
Size 392B
SHA256 d79c7577188da15e97d1bd44c692add6aee73904441ca36115b2788d3b92a6c9
MD5 f9b31eccd30399a9d39b38ceaf5edc32
SHA1 d74b90f96a38962da18d3143f938e9e8aeb7e619
SHA512 711eb0419dd9ca82c1a32cfc06086671e35c61799d1ca8c960b9d03197c3a61be3cc1172cbff805ca207fba8298df2c2abaf18b7d02e23a7bc65131cb8178c41
TLSH
T15CE0722808FE02BEF4B49D798BD9A0B36902E10164A403F240D07301AE03B101CB1834
MD5 SHA1 SHA512 TLSH

Submit Download

A3D5BF1283C2E63D8C8A8C72F0051F5A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
Size 178B
SHA256 f989845bd29cb0303f639f7b5a9e247c8570c51293a2800c4c4c3434d229bea5
MD5 62ba1701832f0bed7415e4418d1840f7
SHA1 9bbdb172666f44e945ff3afc8e36766381df7cff
SHA512 0c50a75ca02c45930237cd04bac71cd740f9d64149b11d2cfa15686b80256838ef70be07382192832b94266b7fc557e203d69699695e1931722519ad6b1fb76e
TLSH
T1F1C08C202A960786E921053D342112206B38A302D70187820BB81004491BA200D32C06
MD5 SHA1 SHA512 TLSH

Submit Download

sdfgdwscvb.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\sdfgdwscvb.exe.log
Size 319B
SHA256 1493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
MD5 600936e187ce94453648a9245b2b42a5
SHA1 3349e5da3f713259244a2cbcb4a9dca777f637ed
SHA512 d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964
TLSH
T167E07230373284E408203A1008027FDA55FF43576768EE2C1619539EE82A0A7EF102E3
MD5 SHA1 SHA512 TLSH

Submit Download

dfgyhtyswq.txt

Path C:\Users\Admin\AppData\Local\Temp\dfgyhtyswq.txt
Size 69B
SHA256 a6983ae35a1f181a50cabf98812ff48f455f4968cd5e400e87654f211b610089
MD5 e36e597217c1f3181a6a27a7e5ac1982
SHA1 3692e5c70e3d4692ddaefc1f12baba765132ccbd
SHA512 ae698eb36630c8f2c77317f623225169743fe34301f8ff8517c95a0169a0dac0516f4b3033031c66c29b89a45105ef4d0f48800946594a8e058a9b461c9439f4
TLSH
T1D1A02283C2E0CB0EBC0AC0833B32B08F80A308C8BB0B2020C300888F00C0000E883302
MD5 SHA1 SHA512 TLSH

Submit Download

sdfgdwscvb.exe

Path C:\Users\Admin\AppData\Roaming\ghghjjkqwes\sdfgdwscvb.exe
Size 1.2MB
SHA256 91736aebc292f7aa6a99944d7a217b86616f5dbd86d7505a9dc0e567c508bf5d
MD5 28c7c3357fdbfef80f92ff8d0efd5988
SHA1 be02669f64bb74b8de0492ef306ad395439c5037
SHA512 57b65b4af21cbcc72e3c8c0b18ed7d2531bf5c31e02642bd297f5e456befd87f10b670cbfa8ba2ea1f8cea2902eb4e141328284d3b763d07ca77edf42c9df5ad
SSDEEP 24576:SvpG2Cojx0pB9w/4Bf1ZXgcPDZuRW3Ane7AxFzEhed1r9:r2bx60/4B3NDcAwe7y+heR
TLSH
T10F45338F6F35EC91F6F385794FDDA341B4FDA5A16755B8020A28506CE0A1C23A6FF818
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.IgHiJkLiO

Path C:\Windows\Microsoft.net\Framework\v2.0.50727\.IgHiJkLiO
Size 68B
SHA256 ca43e58613560ef97e997a52c2c1a9022c96e64b7bc8fd24ae05102875ad28dc
MD5 0ddee9abf830d2f8961294c112354add
SHA1 e4b39e11b716bf0e950307507e1e6ad671f03ee7
SHA512 c9883c2841d901e84a742b8d783f7d62c6342b3792d2b3ce733698fc67bfd42581619ff07643475b22f2c2cd50aa922f8a287da7abd29c93d85d4e379d62c1bf
TLSH
T170A0220C208A0200208000F280B02C80BF0C8AF000E3220CAE20CC22028002A08CC2B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2548-32-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2548-40-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2548-35-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4192-5-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/4192-3-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Download

memory/4192-30-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/4192-4-0x0000000074B32000-0x0000000074B34000-memory.dmp

Download

memory/4192-0-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Download

memory/4192-2-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/4192-1-0x0000000074B32000-0x0000000074B34000-memory.dmp

Download

memory/4296-39-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/4296-27-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/4296-28-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/4328-48-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads