netwire | 5ebee32ab8dfdefe8572ff92a4742ff08efd2917bf228767a41a8bd19fbc7e71

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Size 1.4MB
Sample260602-epwt2sey7p
SHA256 5ebee32ab8dfdefe8572ff92a4742ff08efd2917bf228767a41a8bd19fbc7e71
MD5 9fe88f9435f3d3b2e38b69e6bc6a06f1
SHA1 69af9b20309746a6c09ea0241e61949467f9c8c9
SHA512 f70161f3875603bc4696b769db978228b0003294b988f59ccde3c6ab0932fa391866d4ffe3073cea9a6c78a3ddb6efe15b00aacee8e0bb59e9dff72924066202
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYH:ho0c++OCokGs7Adgrd1f26RNYH
TLSH
T15B65BF52E39EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5EC3AAD21021112DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery execution netwire warzonerat infostealer persistence rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

NetWire RAT payload 21 IoCs

rat

resource	yara_rule
behavioral2/memory/5648-0-0x00000000005C0000-0x000000000072B000-memory.dmp	netwire
behavioral2/memory/5648-1-0x00000000005C0000-0x000000000072B000-memory.dmp	netwire
behavioral2/files/0x0013000000025ad8-6.dat	netwire
behavioral2/memory/1924-13-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1916-16-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/5648-28-0x00000000005C0000-0x000000000072B000-memory.dmp	netwire
behavioral2/files/0x001900000002b570-31.dat	netwire
behavioral2/memory/5168-33-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/2452-51-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/5168-52-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/1916-55-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1916-57-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/6128-58-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/5492-62-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/5492-73-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/4236-78-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/5768-94-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/5768-105-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/4128-111-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2892-132-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire
behavioral2/memory/2892-143-0x00000000005B0000-0x000000000071B000-memory.dmp	netwire

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1100-18-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/1100-26-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/4212-134-0x0000000000440000-0x000000000045D000-memory.dmp	warzonerat
behavioral2/memory/4212-142-0x0000000000440000-0x000000000045D000-memory.dmp	warzonerat

Executes dropped EXE 14 IoCs

pid	Process
1924	Blasthost.exe
1916	Host.exe
5168	RtDCpl64.exe
6128	Blasthost.exe
2452	RtDCpl64.exe
5492	RtDCpl64.exe
4236	Blasthost.exe
5288	RtDCpl64.exe
5768	RtDCpl64.exe
4128	Blasthost.exe
1876	RtDCpl64.exe
2892	RtDCpl64.exe
4888	Blasthost.exe
4212	RtDCpl64.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5648-0-0x00000000005C0000-0x000000000072B000-memory.dmp	autoit_exe
behavioral2/memory/5648-1-0x00000000005C0000-0x000000000072B000-memory.dmp	autoit_exe
behavioral2/memory/5648-28-0x00000000005C0000-0x000000000072B000-memory.dmp	autoit_exe
behavioral2/files/0x001900000002b570-31.dat	autoit_exe
behavioral2/memory/5168-33-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/2452-51-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/5168-52-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/5492-62-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/5492-73-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/5768-94-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/5768-105-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/2892-132-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe
behavioral2/memory/2892-143-0x00000000005B0000-0x000000000071B000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5648 set thread context of 1100	5648	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	82
PID 5168 set thread context of 2452	5168	RtDCpl64.exe	90
PID 5492 set thread context of 5288	5492	RtDCpl64.exe	97
PID 5768 set thread context of 1876	5768	RtDCpl64.exe	104
PID 2892 set thread context of 4212	2892	RtDCpl64.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blasthost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1240	schtasks.exe
4092	schtasks.exe
3864	schtasks.exe
2256	schtasks.exe
5116	schtasks.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 1924	5648	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	80
PID 1924 wrote to memory of 1916	1924	Blasthost.exe	81
PID 5648 wrote to memory of 1100	5648	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	82
PID 5648 wrote to memory of 1100	5648	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	82
PID 1100 wrote to memory of 4956	1100	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	83
PID 5648 wrote to memory of 1240	5648	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	85
PID 1100 wrote to memory of 4956	1100	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	83
PID 1100 wrote to memory of 4956	1100	2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	83
PID 5168 wrote to memory of 6128	5168	RtDCpl64.exe	89
PID 5168 wrote to memory of 2452	5168	RtDCpl64.exe	90
PID 5168 wrote to memory of 2452	5168	RtDCpl64.exe	90
PID 2452 wrote to memory of 1212	2452	RtDCpl64.exe	91
PID 5168 wrote to memory of 4092	5168	RtDCpl64.exe	93
PID 2452 wrote to memory of 1212	2452	RtDCpl64.exe	91
PID 2452 wrote to memory of 1212	2452	RtDCpl64.exe	91
PID 5492 wrote to memory of 4236	5492	RtDCpl64.exe	96
PID 5492 wrote to memory of 5288	5492	RtDCpl64.exe	97
PID 5492 wrote to memory of 5288	5492	RtDCpl64.exe	97
PID 5288 wrote to memory of 5484	5288	RtDCpl64.exe	98
PID 5492 wrote to memory of 3864	5492	RtDCpl64.exe	100
PID 5288 wrote to memory of 5484	5288	RtDCpl64.exe	98
PID 5288 wrote to memory of 5484	5288	RtDCpl64.exe	98
PID 5768 wrote to memory of 4128	5768	RtDCpl64.exe	103
PID 5768 wrote to memory of 1876	5768	RtDCpl64.exe	104
PID 5768 wrote to memory of 1876	5768	RtDCpl64.exe	104
PID 1876 wrote to memory of 6092	1876	RtDCpl64.exe	105
PID 5768 wrote to memory of 2256	5768	RtDCpl64.exe	107
PID 1876 wrote to memory of 6092	1876	RtDCpl64.exe	105
PID 1876 wrote to memory of 6092	1876	RtDCpl64.exe	105
PID 2892 wrote to memory of 4888	2892	RtDCpl64.exe	110
PID 2892 wrote to memory of 4212	2892	RtDCpl64.exe	111
PID 2892 wrote to memory of 4212	2892	RtDCpl64.exe	111
PID 4212 wrote to memory of 5224	4212	RtDCpl64.exe	112
PID 2892 wrote to memory of 5116	2892	RtDCpl64.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1916
- C:\Users\Admin\AppData\Local\Temp\2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-02_9fe88f9435f3d3b2e38b69e6bc6a06f1_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1240

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:6128
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4092

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5484
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3864

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6092
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2256

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Blasthost.exe

Path C:\Users\Admin\AppData\Roaming\Blasthost.exe
Size 132KB
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
SSDEEP 1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rwc5ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3rvZG
TLSH
T1E9D3A419E66BD0F9FD472C7480DFF26F46386D00C534CF62DF953E02DA27921A129AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.4MB
SHA256 ab5a6b453025bb4cb0c380113ae2a8c342e418cb0bc050c65bb150781c3cd1ea
MD5 c0d3b671d173f389e48365a165813c08
SHA1 e0684d092b9e03b95316296cf057be5465f8ec0e
SHA512 0bfb81e714a000c8a9a468b06261eef33a382b13802c7c946a304a031706e15b9b602390b4d66e8fe8e5daaa59cfb301e93cff5c665d6e4fee78b22a125c507e
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYy:ho0c++OCokGs7Adgrd1f26RNYy
TLSH
T1B265BF52E39EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5EC3AAD21021112DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-26-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1100-18-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1212-53-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/1916-57-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1916-55-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1916-16-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1924-13-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1924-11-0x0000000000429000-0x000000000042A000-memory.dmp

Download

memory/2452-51-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/2892-132-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/2892-143-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/4128-111-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4212-134-0x0000000000440000-0x000000000045D000-memory.dmp

Download

memory/4212-142-0x0000000000440000-0x000000000045D000-memory.dmp

Download

memory/4236-78-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4956-29-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/5168-52-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/5168-33-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/5484-75-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/5492-62-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/5492-73-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/5648-0-0x00000000005C0000-0x000000000072B000-memory.dmp

Download

memory/5648-28-0x00000000005C0000-0x000000000072B000-memory.dmp

Download

memory/5648-17-0x00000000036B0000-0x00000000036B1000-memory.dmp

Download

memory/5648-1-0x00000000005C0000-0x000000000072B000-memory.dmp

Download

memory/5768-94-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/5768-105-0x00000000005B0000-0x000000000071B000-memory.dmp

Download

memory/6092-108-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/6128-58-0x0000000000400000-0x000000000042C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads