81e0f36bf3887a6847d354c77257301299a2b7a7df52d48588739a069aec2ebc

Analysis

max time kernel
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsFormsApp15.exe
Size 2.6MB
Sample260701-2bmqjsft9q
SHA256 81e0f36bf3887a6847d354c77257301299a2b7a7df52d48588739a069aec2ebc
MD5 991313ea153c0b61f2ead564082c35f3
SHA1 dd0dba7beec489fba639b0e19fb3d446b2d3bc9e
SHA512 f0871d9d48f2793af1bd1af34493d45fb5662aa29078687cc11e6d051586daa1fbb00bc34bf0b319686ef6f4d0bb15c4a144c0721fb34115408310e00cf0ef17
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/DMwjn3nr:RMshBSD00EC2Jo22n8AZYMm
TLSH
T137C5121817F91A27E27ADD77AAF38113AA71F513A831DE0D148503894433BD7AB92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

costura defense_evasion discovery evasion execution packer persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3376	bcdedit.exe
4204	bcdedit.exe
1092	bcdedit.exe
3956	bcdedit.exe
2464	bcdedit.exe
5716	bcdedit.exe
7968	bcdedit.exe
8020	bcdedit.exe
6740	bcdedit.exe
8108	bcdedit.exe
8344	bcdedit.exe
1524	bcdedit.exe
8704	bcdedit.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6788	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2604	icacls.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c544-43.dat	costura

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2496	sc.exe
3332	sc.exe
9272	sc.exe
5048	sc.exe
5796	sc.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
9800	ipconfig.exe
9780	ipconfig.exe
9756	ipconfig.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
260	schtasks.exe
248	schtasks.exe
52	schtasks.exe
6108	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp15.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp15.exe"
1⤵
PID:5656
- C:\Windows\System32\ReAgentc.exe
  "C:\Windows\System32\ReAgentc.exe" /disable
  2⤵
  PID:2052
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1092
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4204
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3376
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\System32\winlogon_fix.exe" /deny *S-1-1-0:(DE,DC,WDAC,WO,WD,AS)
  2⤵
  - Modifies file permissions
  PID:2604
- C:\Windows\System32\winlogon_fix.exe
  "C:\Windows\System32\winlogon_fix.exe"
  2⤵
  PID:2932
- - C:\Windows\System32\ReAgentc.exe
    "C:\Windows\System32\ReAgentc.exe" /disable
    3⤵
    PID:3948
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5716
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2464
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3956
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinUpdate" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC ONLOGON /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:52
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinCheck" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC HOURLY /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:248
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinStartup" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC ONSTART /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:260
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WinIdle" /TR ""C:\Windows\System32\winlogon_fix.exe"" /SC ONIDLE /I 5 /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create WinDefSrv binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:3332
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create WinUpdSrv binPath= "C:\Windows\System32\winlogon_fix.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:2496
- - C:\Windows\System32\winlogon_fix.exe
    "C:\Windows\System32\winlogon_fix.exe" "powershell.exe" -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
    3⤵
    PID:2520
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} safeboot minimal
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7968
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} safebootalternateshell yes
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:8020
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6740
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" interface set interface name="Ethernet" admin=disabled
    3⤵
    PID:9048
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" interface set interface name="Loopback Pseudo-Interface 1" admin=disabled
    3⤵
    PID:9712
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /release
    3⤵
    - Gathers network information
    PID:9756
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /release6
    3⤵
    - Gathers network information
    PID:9780
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:9800
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="BlockAllIn" dir=in action=block enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:6788
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config LanmanWorkstation start= disabled
    3⤵
    - Launches sc.exe
    PID:9272
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop LanmanWorkstation /y
    3⤵
    PID:3700
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config LanmanServer start= disabled
    3⤵
    - Launches sc.exe
    PID:5048
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop LanmanServer /y
    3⤵
    PID:6168
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config Netman start= disabled
    3⤵
    - Launches sc.exe
    PID:5796
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:8108
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:8704
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1524
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:8344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5704

C:\Windows\System32\winlogon_fix.exe
"C:\Windows\System32\winlogon_fix.exe" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl2.bat
1⤵
PID:4772

C:\Windows\System32\winlogon_fix.exe
"C:\Windows\System32\winlogon_fix.exe" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat
1⤵
PID:3260

C:\Windows\System32\winlogon_fix.exe
"C:\Windows\System32\winlogon_fix.exe" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat
1⤵
PID:3400

C:\Windows\system32\userinit.exe
userinit.exe
1⤵
PID:8388

C:\Windows\System32\winlogon_fix.exe
C:\Windows\System32\winlogon_fix.exe
1⤵
PID:8396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:8316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 7KB
SHA256 02b8508991b402ef7cb154c1a3aa3a11c0c8b7e9cc52209c71627b31cb242d69
MD5 55cd4bb964f7fe36781a16b64c58883d
SHA1 d9baa7a42019a7841a52842fd97140c98a490745
SHA512 da66af546f515c8a9bd2f081feef11432a8bec535241ab46076ef3261751fd0d3c29859e1e63dce09ce63e9051b5142e6e03738ff787e074f56e3a3bfad30d93
SSDEEP 192:J1dL+RIYsF0BrYHQ1qCJGAtUV2axaC9IRdQoYzl7/Jisf+kDqSbIp2hKgCgQEgpN:RK+UglcHTMQglv0
TLSH
T1CCF1031EA2BD88FB6132064280677AD1DCAFF09716451DD8EFD962149621D8F8FCDDC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 7KB
SHA256 f38cb6be8a58fd87e48855162dedf93f5f4befad404be27e6aa728035bfde84b
MD5 685fc3a8387319b0cf6d9e90818378b0
SHA1 fd31d8de915d0ed856f1bf6f87e6126bec8b0110
SHA512 28414473c21ba2e33e1ab1b3aa0831baf2f161080320949f2b75b9b4bf12efc4da4dee85d74763def7dd79d74a5d5489e349c352cc11120b5253acb2fc454bbc
SSDEEP 192:J1dL+RIYsF0BrYHQ1qCJGAtUV2axaC9IRdQoYzl7/Jisf+kDqSbIp2hKgCgQEgpG:RK+UglcHTMQglvV
TLSH
T1BCF1131EA2BDC8FB6132064280637AD2DCAFF0971A451DD8EFD962149621D8F8BCDDC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 7KB
SHA256 3d721adfca5b9fe66b1221fdc29c0839fbf04e0ce62322d1c9108a94cb8dea50
MD5 57d77dc5b32d4a2c16e5fe741c751166
SHA1 5d2f26191f90af16b48012dfcdfa7694baa6dcc5
SHA512 a94de8b4b1e20032365a17c98f3c54a77cf84b205788f4a4977c8a71dfea825c3928b1c6089d64342d8d2095e76058ae9e31e1ced1c8ccd02ffb7e6856c280a2
SSDEEP 192:J1dL+RIYsF0BrYHQ1qCJGAtUV2axaC9IRdQoYzl7/Jisf+kDqSbIp2hKgCgQEgpf:RK+UglcHTMQglvo
TLSH
T1FEF1121EA2BDC8FB6132064280637AD2DCAFF0971A451DD8EFD962149621D8F8BCDDC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 7KB
SHA256 28d63fae011a04b4774d04fae2b4d87516a441c71580503a9fdf2822f9fd8237
MD5 40a1a1525b9cd37a40bac1d52eeb1cdd
SHA1 a3c6e06ac6eebff9edcceb90de6f58553702d358
SHA512 3be8d573371d528847d23a11dc0c14e645a53734865917489d6321733acd2972a0c0fc6ce9a853f7dfcddf10ad7fb64615445beb814c046c321a78ab1d72d388
SSDEEP 192:J1dL+RIYsF0BrYHQ1qCJGAtUV2axaC9IRdQoYzl7/Jisf+kDqSbIp2hKgCgQEgpF:RK+UglcHTMQglvw
TLSH
T1C9F1131EA2BDC8FB6132064280637AD2DCAFF0971A451DD8EFD962149621D8F8BCDDC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 2KB
SHA256 76bffb8a438a1c52432f07705ed20acbbf142e7905abca80032ed6e6e8907c5d
MD5 140f37700f9ca5cd912f52cf2b75e980
SHA1 0e76a3a01eed70ae9d5153d5ac2a9d9df5914fc0
SHA512 2e85a51428aafe84f6fb4eff93835037e1e0dc9fb84f2b7b0479379850d13f66c84bf268765102f2ec6276b6fe4f1740c6a247ec8307d8611c9c5516a3c2330a
TLSH
T17F419C5E12FED87732310042816379C5DAF6F0AB1A5209D8AFE42219E721D8F8BCD9C2
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 2KB
SHA256 7300bfdd6d03ee09c1c4c30986c82f84754cc524bb4322872b78c4d790564b6e
MD5 f1eb91d594f666a3dce26f258dcc0335
SHA1 3bb461b92e0f4d69ee2ca0c3de0422238ef6e471
SHA512 c0580baad2931b19fe63ca98910087ac65b86a27ae043133d6f7239eda47e5aaf1db709ac84290b8fb142f85f91c7fbf91c6590576ec81c187632ceb53b9b85b
TLSH
T1AB51585E22FED87732320042816679C5D9F6F0EB1A5209E87FE46209A711D8F9BDDDC2
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 496B
SHA256 0c238f1dba09a89bc255020ed4020fe0c8e0489994c5b4b25e275ab9512531dd
MD5 4d3efd5ba5b63d3db0826c4027fcc192
SHA1 56e61606eea91403a0af6c535e56a5dbca281eeb
SHA512 ee5e5b8c9318bcffa58b1e659391208e1639078eda8ef4a6ec1cf2a05c9a35d41c73bc1279afdcc4a3c63e14af0fa903c431ecf4052354f422a949c8048fd05c
TLSH
T1FBF05EAA26BEC93B23320443881539D8FCA6F4E36D410DC9AFE4B2448600DDF9EC89C5
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 3KB
SHA256 4162e8faa11d2e8395df62bd589951c09076fd24cddfa01e9cd4fac05f4b8382
MD5 c0cc77fb03825e41f4ff5645b9c45b0d
SHA1 d5aefab2cefd1da97c21b4f22380ff7ca78c91a3
SHA512 4752d6712914e6370c8bf964379c5385fd55e23e51ad12eb39ca2ff8a22dbde1f9a1ff313d7e9aae97f260494b22f08260d8c150461fb0e4724e1f583eca4a52
TLSH
T17F71671E22FED87772310042815239D5DAFBF0DB1A5119E8AFE46219E721D8B8BDDDC2
MD5 SHA1 SHA512 TLSH

Submit Download

zov_debug.log

Path C:\Users\Admin\AppData\Local\Temp\zov_debug.log
Size 4KB
SHA256 79a2aa708bb8f526e633e757606789401707fdeac0579cc6cca27d5ac6c4d051
MD5 913d470d05aac3d687342c2a1e5719f5
SHA1 43b7f5780616cfaae3390ed9c151e816accffab0
SHA512 e69e26c79931562bb74ec90a3305c67f0c99a806127c308b04f34278a560cfda01642ca502e68e45d2303c070ae7281a4ff7663d1f806f91fd552ac77fbabb1f
SSDEEP 96:oS1v1LkzRrHUYsF0B4UYHQ1SbhgfBGAtUV2EVxEVCASIRdCzrUYzl7WqJA1srz+W:J1dL+RIYsF0BrYHQ1qCJGAtUV2axaC9X
TLSH
T1B491871E23BED87771320041816379C4E9E6F09B1A5119E8AFE92219E721D8F8ADDDC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 3KB
SHA256 b459f64bfa75d4073720924e73cf101217bde23950865756c122ef642678c33b
MD5 c9fba0819ced2186ca0ec906af3beaef
SHA1 fd91fb16de4efcf5e7a3b816ef4daaa6fc6f9356
SHA512 7a5cd86820973686ab957e3684bcf2daca82f4febd58f7dd1ef1a19b1b577e2a9c8bd50c66d7800b7695ec6bfb8a47c980744546f9c2bdd314d3ba5ae53dfe19
TLSH
T13F71E52B1EBB8A246545DA50E65218C9DE4372E71B4D74987E7F3181BB0238EC5FDC8C
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 bcbe9eae267ca86341d9a29b23b9a1db06f6aecd7d68032df9c81ac1664d4cf8
MD5 48bb9e8afcad61d7f8aca5a4ff54218c
SHA1 19ebe62d06802efff21b4b39f0bb34d15564868d
SHA512 1444bcb2877c7829d2cd1a70885b5a9f8613eada0a57878775723a3d260a416c85e0d05e5bf1f8f83517c65bbb6b2d9d6d1f432c7cfcc27c3015cfb10a30c951
SSDEEP 192:53gbq3gbq3gbHWAM/1LVw9Bx3gbq3gbq3gbq3gbHYcq:53Iq3Iq3I+63Iq3Iq3Iq3IG
TLSH
T1E862A729B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279082F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 a3e116aba88a654847bf2219bade1964cd14ec497bd26dade142410d85d34b40
MD5 4ca78af577c3990f494fe53729e0427c
SHA1 ab39718300c9a76b54111a1cb647b7406c1efcd6
SHA512 5c2c4403e2889075df93f1a0b3dfc24490147d29c8bda78653afdf99c20785ecff0a8206466c035b1df8b66f8d5c35735e82230615901326fdf3fbd57d926e93
SSDEEP 192:53gbq3gbECcDU5Mfd3gbY3gbq3gbq3gbq3gbE7cbucq:53Iq3ILcTd3IY3Iq3Iq3Iq3Ik
TLSH
T1BE62F539B1952EBB5C9406F8DFD038C26B8097794106A03795C4FEAFB279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.0MB
SHA256 b3c8c4c442385f1329ff8b946ba686aad5da62bc6cb84aee9d03b73988ca90ec
MD5 a8441c1b5e7e58bf6544dbc1711b69bb
SHA1 a88248a83aab7285e997ea4a36be7dd15ba689b7
SHA512 ace14e7509d48a486e96b686011ae1f06218dd4d51dc3b34d3df7b84368ac30a18d15310cc57de1314616733589200256c783cd51c4a889ad187dc20724dade8
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4C:RMshBSD00EC2Jo22n8AZD
TLSH
T1C595021417F91E27E27ADE776AF39113AA31F8175831DE1D148143890433BE2AB96F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.6MB
SHA256 f2fed87620c1235bd53d01a72b5804feacbe61879f2b3366e4b2c275e0f4d8cf
MD5 dbb1b590a967b64e0e71b97d3faa6f5c
SHA1 9019a9602a0206a2d6130c1df79d32950d21963d
SHA512 bc3b68ab26fe8cc9e1ad916fe525b45c0300c9409acd062ccbddc590bfade720c82fd3751bffb6a9cf1b69b977c5c5dc21caecefe2a4e75364fb53d801e33057
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLD48NNUEM1JTf:RMshBS7PErfcEkoq2J3Y2pGEau+8eTf
TLSH
T1D385021427F91E23E276DEB76AF35113A931F8176831DF0D148153894432BE6AB92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.1MB
SHA256 dcb6e11f80890f31bc26b1d67f516cc647d828caf107c86a60cf2a28d3f47345
MD5 d1f5c17a122657e1887cd8ce464c268c
SHA1 f32e667c81631269774b67b87366dd5360b234a7
SHA512 7d803e37163ce79cc7591a3077df40fa8881793f34b6e78442faeb8cb155c0c855b6e598c10ac3f3b071547f845cb3fd0a9ea60478ba768c3e8a044ff699f295
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3Et:RMshBS7PErfcEkoq2J3Y2pGEauw
TLSH
T13045E11427F91E22E276DE776AF35153B931F8276831DF0D148253494033BE6AA92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.3MB
SHA256 d8a9481de92c35c2bb5d0cebd5749cd62a698ceea7e2d6ee08bcd8d0c5e81355
MD5 e46b56795cd9d6a390ee38988dcfddbc
SHA1 95f23c74809d21c2b2cef30b4d65c11e06ff0693
SHA512 8502f075a042bef49fca8fc6b4cde797472568af3af55157c4906e0467543ec9c7973cb4939c2368ffe4fc1e7702ca3982cb8216ec7a9b023216473221660eed
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLD48B:RMshBS7PErfcEkoq2J3Y2pGEau+8B
TLSH
T1CA55F21417F91E22E276DE776AF35153B931F8276831DB0D148253894433BE2AB92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.5MB
SHA256 ef13e37adced90c9b2fc428c00715e1baeb7b478553c9dbf29cba8f4e022919b
MD5 4163894e0a0a275ede768ffc822521dc
SHA1 9b3106830e68bada225f2190737aaa79fc4bdd21
SHA512 91cd6806fe4eea75654fa9b6ebeb7358d06ed9f6bcbfbebaca8317f0695fa7fe3eb103fc83c2bb4fea0674f31b4b4f99cb00a962eb297767f2bda33b19f677b6
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/DMwjnv:RMshBSD00EC2Jo22n8AZYM+
TLSH
T14DC5121817F91E27E27ADD77AAF34113AA71F413A831DE1D148503894433BE6AB92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 813KB
SHA256 498af7dadb9d4e0cae35bad8b8614bd284e52f7df1fc6bb5dcf0df6ddfb61db1
MD5 ac6ab89286db0c640154174907bada49
SHA1 144410f7923953e260017a66d38c92a8ac219a6f
SHA512 688c190ad5aa44223d1257a61692a257b2501e50a789927a755da34854f20e24dd9bcbd199ea7cc6f609df3da946686de8332e7138f09d2022aad3d51b3af1bc
SSDEEP 12288:c8MsT13u2ojSS2/zyl7kCNf4hDZ/WiYPIOXPrYfc+ArceQ3t6oQYQMs9ES:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2S
TLSH
T1FB05C01427F91E62E276DE776AF35153B931F8276831DF0D148243494032BE2AA92F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.2MB
SHA256 d1eb36beed948c1c2240e00b7260578b0dedd78cfcf13e1ba1e95e66fec70e3b
MD5 c92322b5512cd7d804bd92de2aa3f048
SHA1 522c71c22902ef51907461238bd224c3ed397a85
SHA512 b15a6f3c094d39d3465dfe263c49d94dfca75a2f2a71d0ebe37811056d6ce88d25135de60a0375a5353b9ba2dcb03dd4ebb6914274f1b8524b702357b0eb65ec
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EK+:RMshBS7PErfcEkoq2J3Y2pGEauQ
TLSH
T10045F11417F91E22E276DE776AF35153B931F8276831DF0D148253894433BE2AA92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.3MB
SHA256 d2d3227775c033c12aed646c839c1e07ac25bf9759fe857815d7867bb2d110a0
MD5 e80a7640fbe7054b63fc5c6f66a934bf
SHA1 1712249bb3f5f8217df1914e8a47763dda441ff0
SHA512 8158cb89bd50e7257601f3e1fad5ddfc75f25945a8b5d4d87feaa9f5f5e582197062c6904f22dcea0c46cf408845cca56c1f80e162bcd18f1d37ece4d87a0771
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/DT:RMshBSD00EC2Jo22n8AZYT
TLSH
T1E0B5121817F91E27E27ADD77AAF35113AA31F8139831DE1D148543890433BE6AB92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.1MB
SHA256 2cbbed0b02fed1e33c5630296d8a4aa7e939c2e83ff76ce0e3b0982938a67012
MD5 7efdbec1554e587ce270fc83a11725b9
SHA1 be9b79932e31d2856a50195583b6bb22fdf596ac
SHA512 78882c561f4460b9651c07b53d44aa19aa68f1d0c71b79ed94ab222ccfafda15e8a6c78590dc880e4bf11cd1836319bdb7b6070f52aa67f69e4c21127f0626e0
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOQ:RMshBSD00EC2Jo22n8AZG
TLSH
T1E2A5121417F91E27E27ADD77AAF39113AA31F8135831CE1D148143894433BE6AB96F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.4MB
SHA256 50e8563d8cb56c3c1ef8b284383c0dcc2f63464d73f9e0253b254a022c968b8c
MD5 e2af1816c801c13b32565af818cd09fb
SHA1 83667c408de9d7da8b1a452350b89eb42bc31bca
SHA512 310111558782b09253a6d8d5ffb84492141c545a1d0bbf375ffbcd21ae15527ea2cceb2e59004a00e75cf980f4ad11bedb3710d6e82865af1f8b4c910216b92e
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLD48NNU0:RMshBS7PErfcEkoq2J3Y2pGEau+8Z
TLSH
T17165021427F91E22E276DE776AF35113A931F8176831DF0D148253894433BE6AB92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.2MB
SHA256 de4149de7f42d33b4547382fe620bfb143bbeabc021724e5ca312402edeaebe4
MD5 ad26b833914e3399b36606b8e1229521
SHA1 0bd53ecbb2b6fb6e4ee1e17daf3c6903754893b9
SHA512 67b3d0ea7099c213fafbc642835fbbff75dc73ab7c8000d5241814fa71bb3c3ecbd46994aff92fe137a73784d5418af88744a50d51161f3b590d7333ffc6d89f
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/Dc:RMshBSD00EC2Jo22n8AZYc
TLSH
T1C4B5121817F91E27E27ADD77AAF35113AA71F8135831CE1D148543890433BE2AB96F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.1MB
SHA256 f368f39dda9309122e2979aca1e2bc8c97e316c2c9785635ef266e38649e698d
MD5 31611fab3b1ed75d65ff71d1482d6552
SHA1 f880a218c4796d6ed01bcd0473fa8c58ead76498
SHA512 d58704e66caadfdd4d3c4533e83e947524a744fd7c22d9c52881cb8105b2da473b2c9240b6ea1e41920a7b5f5cef50948895c3e6a79d75cd9c3c1c11af19ed0c
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEa1:RMshBS7PErfcEkoq2J3Y2pGEa1
TLSH
T17835E11417F91E22E27ADE777AF35153A931F8176831DF0D148253894033BE2AA92F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.2MB
SHA256 228e69e7d86eb5a7c93c2db7ed92ad5c10a488578022028f2196e23fc74a9c4a
MD5 7064dbd5406e049e45f16cf7aecb85cb
SHA1 5be823606c424b06786c1e46229e3f26432a53e1
SHA512 83643449e9f1125cf7468a808cc7b44ec0f98123c7355275ce4aee04a308e19f885c42e74b063e1717b3d10d5dda38c5ce73b9f11155a89964ed933da1cf81ce
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKb:RMshBS7PErfcEkoq2J3Y2pGEauB
TLSH
T11E45F11417F91E22E276DE776AF35153B931F8276831DF0D148253894433BE2AA92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.2MB
SHA256 1e0b3e1add92260a0245b6b5bfc9af95dbf66390870530d3af1caa9c8c106fd5
MD5 a5664644abc622f7c205142dbe493925
SHA1 8fe41869671be2b4ea4acb186c3613df1a65bd2a
SHA512 135d65166eaa886843bc0861da36e1c93e21faf3d2907740fc3272c13e51a532d8a94c1b84624b0d138c78d267d012a4ffab0af019dd537fadbd3a6306cf6814
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLP:RMshBS7PErfcEkoq2J3Y2pGEaux
TLSH
T11855F21427F91E22E276DE776AF35153B931F8176831DF0D148253894433BE2AA92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.0MB
SHA256 dba35aa6c63e2af13f61564298b0f13e0fd19ecfe178bfedc9e6019838c4da0e
MD5 9ef4ee8b3ae96ebf1f3f12147ec04a67
SHA1 9967b031b7720ab7e287989a5f630540b42298dd
SHA512 27fe889a66517bdc06282d64e7bee5444f9bab5c144f2dc597c9c208ab7c637500de2be998624a6f85ac05c4b2d7bbf01fd553a87129ebb6f13f4b2dd86dcb69
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEx:RMshBS7PErfcEkoq2J3Y2pGEx
TLSH
T13C35E11417F91E22E27ADE777AF35153A931F8276831DE0D148253494033BE2AA92F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.4MB
SHA256 b1fc2cb112e943f21623e8316f8f343edbe11217e1a4cbbba9a34aa2f4de3c1b
MD5 c24e7ba5fd0f7a19eac3876c29a83fb6
SHA1 fff9130dfb7904c633b11c69a3d5282d98214b97
SHA512 5ceebc347911e5441751eecbbbce8d5dfd154bdc3d62f5e1c327d69b1959235a6e68a2207c85dcd60d67899c5cf3ecf8ba0d9525f2400195b3e461f75dca3a8d
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLD48NNUT:RMshBS7PErfcEkoq2J3Y2pGEau+8G
TLSH
T14C65021427F91E22E276DE776AF35113A931F8176831DF0D148253894433BE6AB92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.4MB
SHA256 2a4f47d3d3ede1113ff4386208be0699784c03f01ea76cf69add2b80d8461b41
MD5 2c2bd90944984fbea2805e1ef7d64a2e
SHA1 95b73519183febdee1f6834f8243dd28852d35c4
SHA512 bb91c3dc9b39a57e6427b5a3f6a6069452047de7d0c1df181acfce4ce2290c3c66f490192ae6a5c834d32c8e19ecf241c8594f1fc8ae285a8687cdef6f3a0db6
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLD48NNUO:RMshBS7PErfcEkoq2J3Y2pGEau+8j
TLSH
T12F65021427F91E22E276DE776AF35113A931F8176831DF0D148253894433BE6AB92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.2MB
SHA256 e92e4c1696c4987958ce4d9cbd39db18a7f7eb9793175cf8a8ee66a291bcd0b8
MD5 a477d2cb143fa3441be8a929e5f3d56b
SHA1 a0f8f8980f9f291f1a3cfd2ec7255bba0e5cd545
SHA512 175b0545b2170a0105db656aad66b682dc4c85c3977174ef56ac3ba6cea99a9da48d73bb9dc81d53734941d77cd12a1200ab28e7c3a4620457c0da42230c9d6f
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKL2:RMshBS7PErfcEkoq2J3Y2pGEaug
TLSH
T1DB55F11427F91E22E276DE776AF35153B931F8276831DF0D148253494433BE2AA92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.0MB
SHA256 3a8b98dba959fed162537267c02b595335d4911c2453f6903a8f0a7f42b1fb2c
MD5 8ae620a27bc05a0215253c0fc9941d33
SHA1 e8582bbb21f0fc25c629338dcdba4ef9e7f4e76c
SHA512 fdf3ef218dd2f78443a858ee9547b27c3e0dc76f9a555827cd8a05385ccfe362a93d9aad5e12eb0d094a337cf4b9ee2b67a3a00cbaf7577375a4577ff7b11b00
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rV:RMshBSD00EC2Jo22n8AZA
TLSH
T142A5121417F91E27E27ADD776AF39113AA31F8179831DE1D148103890433BE6AB96F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 1.3MB
SHA256 9e82c48d49b2256bba98e425dd151910fbcf4711b8338927e47dd5c5d59fbb8b
MD5 6ec101d74fe534cb38f02dc9959af5b5
SHA1 0f067072e52e5794242f302f8491c35697ae83a0
SHA512 f361a57b74d4aba80ef9c82e2f2c16d90d1ad9e82f77dcfd8e7801f0cdf19f0cdcbc0f7ab6026ce9ee42d6f27bd68ea942f21c1974d8c5b0e801daf954f99598
SSDEEP 24576:RMsh3kSSCzyPNqlhrfc1hQ3Uo9s2Zj3YsDClQGEaud3EKLD488:RMshBS7PErfcEkoq2J3Y2pGEau+88
TLSH
T1F955F21427F91E22E276DE776AF35153B931F8176831DB0D148253894433BE2AB92F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon_fix.exe

Path C:\Windows\System32\winlogon_fix.exe
Size 2.6MB
SHA256 81e0f36bf3887a6847d354c77257301299a2b7a7df52d48588739a069aec2ebc
MD5 991313ea153c0b61f2ead564082c35f3
SHA1 dd0dba7beec489fba639b0e19fb3d446b2d3bc9e
SHA512 f0871d9d48f2793af1bd1af34493d45fb5662aa29078687cc11e6d051586daa1fbb00bc34bf0b319686ef6f4d0bb15c4a144c0721fb34115408310e00cf0ef17
SSDEEP 49152:RMshBS7PErfcEkoq2J3Y2pGEau+8eT/8Avh4rOg3/DMwjn3nr:RMshBSD00EC2Jo22n8AZYMm
TLSH
T137C5121817F91A27E27ADD77AAF38113AA71F513A831DE0D148503894433BD7AB92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5656-24-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-20-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-19-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-21-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-23-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-0-0x00007FFD1AC8F000-0x00007FFD1AC90000-memory.dmp

Download

memory/5656-22-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-60-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-18-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-13-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-12-0x00007FFD1AB00000-0x00007FFD1B4A4000-memory.dmp

Download

memory/5656-1-0x000001D091210000-0x000001D0914AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads