glupteba | 1e146ab127759a07a58c869ea63459fb611607750ea7c023ffe36a56079658c9

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpgs2fssd_.exe
Size 4.2MB
Sample260602-ll3lrabt5n
SHA256 1e146ab127759a07a58c869ea63459fb611607750ea7c023ffe36a56079658c9
MD5 42149f8ec356bdf12748114fe2a2295f
SHA1 d2f8fbb889f8b8e28b98352dd3e17230a41f0893
SHA512 331480733f6cd4dbac6274475671005b720d0454df2d24c19907f3d58c53ae2e0db44f5f3125fa4073a03669a3a7ebc229c1e8423144f97093904a2df50d8e34
SSDEEP 98304:c6H24mpQm717nbjFmPd67NkwNcs1opl8cEKAHlzz3V+w4HSn:BHapQw17nbjFmPiNf1opXEKAZ8wuSn
TLSH
T134163302A2947FA0FA1A0F739F0DDBF856EE79910D153B9B1218691F01732F292736B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit spyware trojan

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 21 IoCs

resource	yara_rule
behavioral3/memory/4616-2-0x0000000003120000-0x0000000003A0B000-memory.dmp	family_glupteba
behavioral3/memory/4616-74-0x0000000003120000-0x0000000003A0B000-memory.dmp	family_glupteba
behavioral3/memory/4616-124-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/5400-171-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/6100-181-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-246-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3940-247-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/4876-249-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/4772-250-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-252-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-258-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-264-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-270-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-276-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-282-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-288-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-294-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-300-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-306-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-312-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral3/memory/3392-318-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5164	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
3392	csrss.exe
3940	csrss.exe
6100	csrss.exe
4876	csrss.exe
4772	csrss.exe
3120	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpgs2fssd_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
9	raw.githubusercontent.com

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpgs2fssd_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpgs2fssd_.exe
File created	C:\Windows\rss\csrss.exe	tmpgs2fssd_.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4104	powershell.exe
2424	powershell.exe
3472	powershell.exe
2980	powershell.exe
3344	powershell.exe
2532	powershell.exe
2036	powershell.exe
2056	powershell.exe
1144	powershell.exe
2488	powershell.exe
4772	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgs2fssd_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpgs2fssd_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5464	schtasks.exe
2040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4772	powershell.exe
4772	powershell.exe
4616	tmpgs2fssd_.exe
4616	tmpgs2fssd_.exe
2980	powershell.exe
2980	powershell.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
5400	tmpgs2fssd_.exe
3344	powershell.exe
3344	powershell.exe
4104	powershell.exe
4104	powershell.exe
2532	powershell.exe
2424	powershell.exe
2532	powershell.exe
2424	powershell.exe
3940	csrss.exe
3940	csrss.exe
3472	powershell.exe
3472	powershell.exe
2036	powershell.exe
2036	powershell.exe
2056	powershell.exe
2056	powershell.exe
1144	powershell.exe
1144	powershell.exe
4876	csrss.exe
4876	csrss.exe
2488	powershell.exe
2488	powershell.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3392	csrss.exe
3392	csrss.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3392	csrss.exe
3392	csrss.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe
3120	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4616	tmpgs2fssd_.exe
Token: SeImpersonatePrivilege	4616	tmpgs2fssd_.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	3940	csrss.exe
Token: SeImpersonatePrivilege	3940	csrss.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	4876	csrss.exe
Token: SeImpersonatePrivilege	4876	csrss.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeSystemEnvironmentPrivilege	3392	csrss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4772	4616	tmpgs2fssd_.exe	122
PID 5400 wrote to memory of 2980	5400	tmpgs2fssd_.exe	85
PID 5400 wrote to memory of 3204	5400	tmpgs2fssd_.exe	87
PID 3204 wrote to memory of 5164	3204	cmd.exe	89
PID 5400 wrote to memory of 3344	5400	tmpgs2fssd_.exe	90
PID 5400 wrote to memory of 4104	5400	tmpgs2fssd_.exe	92
PID 5400 wrote to memory of 3392	5400	tmpgs2fssd_.exe	94
PID 3392 wrote to memory of 2532	3392	csrss.exe	97
PID 3940 wrote to memory of 2424	3940	csrss.exe	99
PID 6100 wrote to memory of 3472	6100	csrss.exe	102
PID 3392 wrote to memory of 2036	3392	csrss.exe	113
PID 4876 wrote to memory of 2056	4876	csrss.exe	118
PID 3392 wrote to memory of 1144	3392	csrss.exe	120
PID 4772 wrote to memory of 2488	4772	csrss.exe	123
PID 3392 wrote to memory of 3120	3392	csrss.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe
"C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpgs2fssd_.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5164
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2532
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3120
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2040

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3472

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 ac11334de01da46e72c39470b85c83c2343ed93e23f34c8b1bad6f0ec483d785
MD5 53a89d800a145a44d82d81cfc421a6d1
SHA1 320955aff6ce7ca57595fa62db6f9092ffbcb4ab
SHA512 ceb71f0854f89a1f2dee8e25b7e1af4bd6dc635a12a3a986c3b66a81b317d08e6ee2f169c6e1e4a2fa2cfecbfd46f3a85a65fed6cea8e2226663dce4fd08a5b4
SSDEEP 384:yL3HhwwSS1kBAggoFRHEMEPHnnNvjQGIZmLj57sUjjumyEIDjiJsLOj9FFy:8xJSSAD5RPE/NvjfIZmL97xjul9Djiaf
TLSH
T1BC92C5AE711F26C3C89553B8D106040FE8F2DE8D031966DDB72E8F7B89AC99E417D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 a5f0adf342df28c8885f0cbf1f57b725edaaf10b8b5e950079c70eb98b61de4a
MD5 cd5e0848fbaa14e978d628de4f676efd
SHA1 bf2d1f599f434570ccea0396f5c906c34a9f7d40
SHA512 e5089e848804a8f4b9e2b9a91fb68b2bade58ab1560ba2bc789aa1718f18b7c700b998c17632ec4e89234efb71c9d465badd33023245ec09ee1372b61835eecf
SSDEEP 384:GL3Hhwz1SGALPvPugBzRyhk3eYcznNKaK2UG5RdjuoGeIRJiWx/SnY9phAUd5H:wxISjjPugNR36xKaBz5Rxu3biW599pGy
TLSH
T138923A59225F2ADBE4AA23B8C012078FF5F28DDDC3009BDE770A583B059A69544FD5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_m1z5dyjh.nkc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m1z5dyjh.nkc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 95ea43dcd566f99b219b231d36f05900427bcad37905aa7a4c0ee9739356a34e
MD5 2fbdaa2aa70b6f17ecba3941140f3958
SHA1 72125c9109a83ab0165b71f2bd51df47a455d429
SHA512 cb08a982244ca0204431c0cd3418586cdb9f2813500fbb47df7c608d8c89e2807879e70a6568dd721442900829aeda82988206e06f1ef9eea9788de7ab8c996d
SSDEEP 384:UL3HhwiStpE+Hd+4mggnlNwCa1Ks+NeYfG/4bnuzenY9jhUd9H:6KiS73H4yWwCa1Ks+Nb7buzB9lUr
TLSH
T1E892296E226F26EBE4A513F8C0220397F9F09ECFC30413DD664A593B06CE6B154985ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e678b6fc54544000f5cea14c923fda6e6dff344b9475de0387bf087b6ad9e1f1
MD5 9b6ae1fc8e7e398aea066c0d792ee823
SHA1 66185afeaff2ba699bd8c3529feda934261566c7
SHA512 ce75c87d653ee0db3a0698c9b99ec5f2ee1ee799734934358b037fdbf5b14e807073e08d7dfd22e9eabc86cd2eec224e10a08b33e94c66fb09dccf5c8087c6d3
SSDEEP 384:GTHhtmSJgi2xCySGJQseYcT7GwjWaK2uLkjMHmm00Iz7nY9jhUdN7H:cmSb2HJQPfjWaBuLczk9lUv
TLSH
T1CF922A5D222F229BE4A523F8842317DBFDA09DCFC30056DE5619693B06DB6B448E49FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ff3762c10d5ff41f6ef9dcf24b809e31082f8c2a05ed0b17882893e446411b1a
MD5 79d3c1983ab9a27112bcaa62dbea4eb5
SHA1 b3f69bc141cba196f334fc66d69c50ee4b7f5c6c
SHA512 92361a084c35e83d897f425b2d4f33c45dc410a612576d465473b87b1f9916881eaac8f5c9d39d4c1ac077cadb03ded248b64677fe724bd46d61ba0987a634e5
SSDEEP 384:WTHhz1S2kls4cy/BR01QzOnHpCaK2uLNXjCgN/6irnY9jhUd0H:YS3C4tZRLSJCaBuLNzZp6iU9lU4
TLSH
T18F92066D222F2657C4A522F4902607DFE9E49ECF8384D3DE17184C3F16CB6B1A4A56F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 d5322486f593f7af6d49d5d85ed55bb6a4b0efa14f02eaeccfba7c6e46e27d28
MD5 d9937caf3ed6b2398c57b2f123db4de4
SHA1 a2d57e4ae332d28f6b761304db7c7c50268fd7a7
SHA512 e75533b73bce75ba5fe4dfa2b449b18aae826f4182124b49962f9c5b46a680de24d773c24a5217441563bf63d94e4897cb4f4e814a0cce630ee751cf0d0e62bf
SSDEEP 384:MTHhwiStnPckFRHNELCeJH8FjWa1ICmLNvjUHbY4z/nY9jhUdtP:riS9BRtELFIjWa1ICmLN70bjzA9lUz
TLSH
T143922A5D226F2697C4A923F8C022039FEDF08ECF830453DE635A5D3B06CE27554A85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c91b8ca8b6c951b7ab396167708bce7ea0e7c3957ca392e1fadfd0883534e228
MD5 10cb9caba95b04021a82c9ec44da664d
SHA1 6e0aa7b31dfafe491722f0794f5efa71a26af420
SHA512 b1f3a57dae74a4070e77b8ce4368502e8730b87608c06035b3eb8d8fd2d9a58f1e0494c5c73a5bc9e1fb9b11921d51572dd2c1736087f9dd90a44594f76760b0
SSDEEP 384:EPHhwiSJgXgyDIKRJ3AuCPnNzjQGII+NXjg2x+b3zHz5RjNuVF+:XiSywyDHRJ3AtlzjfII+NzgC+b3zz5+u
TLSH
T1FE92C59E715F12C3C88553B8D20A050FE8F2DE8D031A53D9BB2E9F7B89AC55E513D648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 850bb8cd81f7a7a19eeb4c4053e1e14583b435b583e528026bd8a72e7cf21b55
MD5 5a7f886d7b66b5a2a9674994d05a4d4b
SHA1 f57ef577a99658d4a50fb6e3b12763d75ff5944a
SHA512 0502f63109bef97f3956ea8dbe577030368e59b04f8dcd7cdda8ee1ded55ece6db40b7b8b0ddad1f94040d1249f41b619be68528bf8b40e67e729cd42ad38bcf
SSDEEP 384:bPHhv1Sv51A8qi4MEqUT/ZNdM1jfICGLNXgHbT6zbnY9jhUd8H:HSvfAbiDErXG1jfICGLNwbmzE9lUk
TLSH
T15992196D326F26DBC4A913F8C026079BEDB08ECF430453EE635A9D3B06CB67544594E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.2MB
SHA256 1e146ab127759a07a58c869ea63459fb611607750ea7c023ffe36a56079658c9
MD5 42149f8ec356bdf12748114fe2a2295f
SHA1 d2f8fbb889f8b8e28b98352dd3e17230a41f0893
SHA512 331480733f6cd4dbac6274475671005b720d0454df2d24c19907f3d58c53ae2e0db44f5f3125fa4073a03669a3a7ebc229c1e8423144f97093904a2df50d8e34
SSDEEP 98304:c6H24mpQm717nbjFmPd67NkwNcs1opl8cEKAHlzz3V+w4HSn:BHapQw17nbjFmPiNf1opXEKAZ8wuSn
TLSH
T134163302A2947FA0FA1A0F739F0DDBF856EE79910D153B9B1218691F01732F292736B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-211-0x00000000715F0000-0x0000000071947000-memory.dmp

Download

memory/1144-210-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/1144-222-0x0000000005C10000-0x0000000005C25000-memory.dmp

Download

memory/2036-172-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/2036-173-0x00000000715F0000-0x0000000071947000-memory.dmp

Download

memory/2056-200-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/2056-218-0x0000000006220000-0x0000000006235000-memory.dmp

Download

memory/2056-201-0x00000000715F0000-0x0000000071947000-memory.dmp

Download

memory/2056-208-0x0000000007C20000-0x0000000007CC4000-memory.dmp

Download

memory/2056-209-0x0000000007E10000-0x0000000007E21000-memory.dmp

Download

memory/2424-134-0x0000000070F10000-0x0000000071267000-memory.dmp

Download

memory/2424-133-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/2488-230-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/2488-231-0x00000000715F0000-0x0000000071947000-memory.dmp

Download

memory/2532-125-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/2532-126-0x0000000070F10000-0x0000000071267000-memory.dmp

Download

memory/2980-52-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/2980-53-0x0000000070F10000-0x0000000071267000-memory.dmp

Download

memory/2980-60-0x00000000077F0000-0x0000000007894000-memory.dmp

Download

memory/2980-61-0x0000000007B10000-0x0000000007B21000-memory.dmp

Download

memory/2980-63-0x0000000007B60000-0x0000000007B75000-memory.dmp

Download

memory/3344-73-0x00000000056E0000-0x0000000005A37000-memory.dmp

Download

memory/3344-76-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/3344-77-0x00000000716D0000-0x0000000071A27000-memory.dmp

Download

memory/3392-264-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-306-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-246-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-252-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-258-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-318-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-312-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-270-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-300-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-294-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-276-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-282-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3392-288-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/3472-170-0x0000000005020000-0x0000000005035000-memory.dmp

Download

memory/3472-155-0x00000000715F0000-0x0000000071947000-memory.dmp

Download

memory/3472-151-0x0000000005750000-0x0000000005AA7000-memory.dmp

Download

memory/3472-169-0x0000000007270000-0x0000000007281000-memory.dmp

Download

memory/3472-153-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Download

memory/3472-154-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/3472-162-0x0000000006ED0000-0x0000000006F74000-memory.dmp

Download

memory/3940-247-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/4104-94-0x0000000070FE0000-0x0000000071337000-memory.dmp

Download

memory/4104-93-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/4104-85-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/4616-74-0x0000000003120000-0x0000000003A0B000-memory.dmp

Download

memory/4616-1-0x0000000002D20000-0x000000000311C000-memory.dmp

Download

memory/4616-124-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/4616-62-0x0000000002D20000-0x000000000311C000-memory.dmp

Download

memory/4616-2-0x0000000003120000-0x0000000003A0B000-memory.dmp

Download

memory/4772-3-0x0000000005550000-0x0000000005560000-memory.dmp

Download

memory/4772-16-0x0000000006760000-0x000000000677E000-memory.dmp

Download

memory/4772-8-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download

memory/4772-7-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/4772-18-0x0000000006D00000-0x0000000006D46000-memory.dmp

Download

memory/4772-20-0x0000000007B70000-0x0000000007BA4000-memory.dmp

Download

memory/4772-15-0x00000000062C0000-0x0000000006617000-memory.dmp

Download

memory/4772-21-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/4772-22-0x0000000070F10000-0x0000000071267000-memory.dmp

Download

memory/4772-6-0x00000000058D0000-0x00000000058F2000-memory.dmp

Download

memory/4772-5-0x0000000005B90000-0x00000000061BA000-memory.dmp

Download

memory/4772-4-0x00000000032A0000-0x00000000032D6000-memory.dmp

Download

memory/4772-19-0x000000007FD00000-0x000000007FD10000-memory.dmp

Download

memory/4772-32-0x0000000005550000-0x0000000005560000-memory.dmp

Download

memory/4772-17-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/4772-30-0x0000000005550000-0x0000000005560000-memory.dmp

Download

memory/4772-33-0x0000000007BF0000-0x0000000007C94000-memory.dmp

Download

memory/4772-31-0x0000000005550000-0x0000000005560000-memory.dmp

Download

memory/4772-29-0x0000000007BD0000-0x0000000007BEE000-memory.dmp

Download

memory/4772-250-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/4772-35-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Download

memory/4772-42-0x0000000007E50000-0x0000000007E58000-memory.dmp

Download

memory/4772-41-0x0000000007E30000-0x0000000007E4A000-memory.dmp

Download

memory/4772-40-0x0000000007DE0000-0x0000000007DF5000-memory.dmp

Download

memory/4772-39-0x0000000007DD0000-0x0000000007DDE000-memory.dmp

Download

memory/4772-38-0x0000000007D80000-0x0000000007D91000-memory.dmp

Download

memory/4772-37-0x0000000007E70000-0x0000000007F06000-memory.dmp

Download

memory/4772-36-0x0000000007D60000-0x0000000007D6A000-memory.dmp

Download

memory/4772-34-0x0000000008360000-0x00000000089DA000-memory.dmp

Download

memory/4876-249-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/5400-171-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download

memory/6100-181-0x0000000000400000-0x0000000000D1B000-memory.dmp

Download