salatstealer | b44b18c931343c5e7d9729a3883dcf33bafd193bb71d284f168d27269af898d3

Analysis

user interaction
yes
max time kernel
11s
max time network
47s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GEJSER v2.2.exe
Size 19.2MB
Sample260707-e9c8faez8p
SHA256 b44b18c931343c5e7d9729a3883dcf33bafd193bb71d284f168d27269af898d3
MD5 b5d83cac5ae99579de029645ebde1611
SHA1 6a5e3ab3fe4bbd60eaf5b3edd3a90856e4fe0c54
SHA512 3655c2c1d04ea87bc61bbaf22b68fa297b3d9fece8920b81bfea38b7abbb554b276a6481121844634e8348ea89a487c97819d87e88da1d928bbae2d3399f74fd
SSDEEP 393216:4oT4+fqm8ry+SfHPosWv9gCoV7lxuCKDeS5UfLE0Yx7ZMYq174CWPyee:bkC8riPofv98NRieOqEvlGZr2yee
TLSH
T1D517331B616DB936DC9366B8F3A31703274DCBCE864E50B0FB038B7A4F59C10A9945B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer xmrig miner persistence stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect SalatStealer payload 14 IoCs

resource	yara_rule
behavioral2/memory/1588-28-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/2344-33-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/2220-37-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/3968-38-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/3968-39-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/2280-59-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/2432-68-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/2052-95-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/3968-96-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/1116-118-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/4440-138-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/3968-189-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/1708-203-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer
behavioral2/memory/4664-206-0x0000000000BF0000-0x0000000001847000-memory.dmp	family_salatstealer

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/3944-178-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-183-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-182-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-186-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-185-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-184-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-181-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-179-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-187-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig
behavioral2/memory/3944-188-0x0000000140000000-0x00000001408B4000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1968	powershell.exe
4176	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
2492	fv.exe
3968	fivem.exe
1996	fv.exe
1588	fivem.exe
3364	fv.exe
2344	fivem.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1200	powercfg.exe
4780	powercfg.exe
2964	powercfg.exe
4128	powercfg.exe
4540	powercfg.exe
1792	powercfg.exe
4848	powercfg.exe
4856	powercfg.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001a00000002b4ea-17.dat	upx
behavioral2/memory/3968-21-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/1588-25-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/1588-28-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2344-31-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2344-33-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2220-36-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2220-37-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/3968-38-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/3968-39-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2280-49-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2280-59-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2432-65-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2432-68-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2052-94-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/2052-95-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/3968-96-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/1116-116-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/1116-118-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/4440-138-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/3944-178-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-183-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-182-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-186-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-185-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-184-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-181-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-179-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-177-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-176-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-174-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-175-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-173-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-187-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3944-188-0x0000000140000000-0x00000001408B4000-memory.dmp	upx
behavioral2/memory/3968-189-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/1708-203-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/4664-206-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/memory/4244-210-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx
behavioral2/files/0x001900000002b546-216.dat	upx
behavioral2/files/0x001900000002b546-215.dat	upx
behavioral2/memory/3968-218-0x0000000000BF0000-0x0000000001847000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3348	sc.exe
1088	sc.exe
2268	sc.exe
3364	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fivem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fivem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fivem.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2492	4800	GEJSER v2.2.exe	79
PID 4800 wrote to memory of 3968	4800	GEJSER v2.2.exe	80
PID 4800 wrote to memory of 4636	4800	GEJSER v2.2.exe	81
PID 4636 wrote to memory of 1996	4636	GEJSER v2.2.exe	82
PID 4636 wrote to memory of 1588	4636	GEJSER v2.2.exe	83
PID 4636 wrote to memory of 3460	4636	GEJSER v2.2.exe	84
PID 3460 wrote to memory of 3364	3460	GEJSER v2.2.exe	121
PID 3460 wrote to memory of 2344	3460	GEJSER v2.2.exe	86
PID 3460 wrote to memory of 4768	3460	GEJSER v2.2.exe	87

C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
"C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\fv.exe
  "C:\Users\Admin\AppData\Local\Temp\fv.exe"
  2⤵
  - Executes dropped EXE
  PID:2492
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3712
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3824
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:4780
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:4540
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4128
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:2964
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "FV"
    3⤵
    - Launches sc.exe
    PID:3348
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "FV" binpath= "C:\ProgramData\FV\main.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1088
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2268
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "FV"
    3⤵
    - Launches sc.exe
    PID:3364
- C:\Users\Admin\AppData\Local\Temp\fivem.exe
  "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3968
- - C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe
    "C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe"
    3⤵
    PID:3032
- C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
  "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Temp\fv.exe
    "C:\Users\Admin\AppData\Local\Temp\fv.exe"
    3⤵
    - Executes dropped EXE
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\fivem.exe
    "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
    "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\fv.exe
      "C:\Users\Admin\AppData\Local\Temp\fv.exe"
      4⤵
      Executes dropped EXE
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\fivem.exe
      "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
      "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
      4⤵
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        5⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        6⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        8⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        8⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        8⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        9⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        9⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        9⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        10⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        10⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        10⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        11⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        11⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        11⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        12⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        12⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        12⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\fv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fv.exe"
        13⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\fivem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fivem.exe"
        13⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GEJSER v2.2.exe"
        13⤵
        
        PID:3708

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4536

C:\ProgramData\FV\main.exe
C:\ProgramData\FV\main.exe
1⤵
PID:1696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:1624
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3940
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:4856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4848
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1792
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1200
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2016
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  PID:3944

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenuExperienceHost.exe

Path C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe
Size 704KB
SHA256 c8262a8201f848c9fa784b9f1467daa135f46b43d0a220e6f3b6d3dbee6f2893
MD5 f9fab9c9c9f3f5ae14348a1f18464338
SHA1 9c7bcd379caff8c4d0f752b17d466e26ead48feb
SHA512 3d974fe20fb08bf5564533a4157cbc55f60c50fd8df7779ff4267032688f93ab04982e11cc3f01ae4460a595f2fc74fb9923bf8242afbcb547a71689cc8984f7
SSDEEP 12288:f4uEKnqo/vH87ujPkZ4Tcr6ifDIQIq3LKoEi206c70KXvuBo1K/z28oi1e9nrLAk:fdEKqo3HMZ4IpLIBPT0z0A4oUpnQIOz
TLSH
T174E433CDDF65EA62D623DD7A93D10679208DAF1D4F842612FF43AE28635BC07809C867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenuExperienceHost.exe

Path C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe
Size 640KB
SHA256 f0801ef9af041d10465328aea285928b82f804bb984fbc6a74dffe8786d8cfbe
MD5 97cd17aefb49abc7455621b063abb92a
SHA1 6eda46de8ed32eed42eba7a06139ed23a9a5088b
SHA512 65dd923475456410cf9cd5fc4856c24833381196ffd00414af44c24156fcb04a0cd4f48b3e1b35a5943c1551fdf31a2ec94e04dc612e541bae43729fdd526ace
SSDEEP 12288:f4uEKnqo/vH87ujPkZ4Tcr6ifDIQIq3LKoEi206c70KXvuBo1K/z28oi1e9nU:fdEKqo3HMZ4IpLIBPT0z0A4oUpnQU
TLSH
T1A5D423CDCFA4EA12E6239D7A57D1067C348DAF4D4F846A16FF53AD28236BC07C098856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEJSER v2.2.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GEJSER v2.2.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 1009564c367455ccd68664fbce7ef27d425eb44771e7da11e1a39d6f73925604
MD5 f47dbc2c10a6c5d4d1066c1ffc8dffdf
SHA1 18b9f2d01c0c8a037205a3420e651c24719a5412
SHA512 7c27cc5e0e189a418802d25ed2e70fa03519246c8825e0bcc35af1ad390b1504d585f89de01bf89281578b2e45ca1553822cf87734a2dd49acb13fd5c98e8123
SSDEEP 384:hJWJGVca12krtuVm+GglBOVjeQ8RJoAVghkjUuRWq5PVm57+GDa500bEYAVbc83r:f+GVcWrjl8RJ3VgajUuRrG7+GDa500bW
TLSH
T14EA24B743AF51319F3F69F749AF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tpo2s0dt.g40.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tpo2s0dt.g40.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fivem.exe

Path C:\Users\Admin\AppData\Local\Temp\fivem.exe
Size 3.4MB
SHA256 cd03c36b0617b39fbb64db96769d2b18de5b62bbebb744a98c9fb6f51f7d95e7
MD5 276a65f41ca977afffb358b64c78b7e1
SHA1 03bd8742edf65006ce34ed06c8c5341fb34f6086
SHA512 bed66dc8fe264a20f23653bf7fffadbaccc31f33e1697d2e96082ec838e4372f90ef07c2c94a114268b80f5778e98a75ee5e8095e57004e8574938a23f18520a
SSDEEP 98304:fPFsZV+7BbONg5VGjdJiGPT2vClEnDQygtAL:K7+7Bb96jOGP6aLAL
TLSH
T1D3F533CDE165F463FB63DCF2F2CF2B67190AC745868893D05291AE2A9A7ED50830417B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fv.exe

Path C:\Users\Admin\AppData\Local\Temp\fv.exe
Size 3.0MB
SHA256 b359721a3858a451a51b8468d9200b01c2076e0601b57949c034dc09a52f7285
MD5 c95d479fb36f8233a6e6561cde80094b
SHA1 b77ac7c3834f8d165adcc202e4052046366376e9
SHA512 1092b94056727c8a5ff09bba32b2779d498f462d00cbdc5c766f1f27cb7d0f4389b81ccfacaf974c06ed86c38b965c8eb4480a2c031e2462c02806e44673d7b8
SSDEEP 98304:2eiCa+GamXBCCZ/5z7pvdQFJpdi9X+v07uL:xiF3amXBCYN3HX+7
TLSH
T175E533C04DC6393CC5FB077C849B9F6D6A01B6120B116DCB52A17A618F62BD76723F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-159-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-163-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-158-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-152-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-160-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-161-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-162-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-154-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-153-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/984-164-0x000001E9F60C0000-0x000001E9F60C1000-memory.dmp

Download

memory/1116-118-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/1116-116-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/1588-25-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/1588-28-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/1708-203-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/1968-60-0x000001CF38C20000-0x000001CF38C2A000-memory.dmp

Download

memory/1968-62-0x000001CF38C30000-0x000001CF38C3A000-memory.dmp

Download

memory/1968-66-0x000001CF38C90000-0x000001CF38CAA000-memory.dmp

Download

memory/1968-57-0x000001CF38B60000-0x000001CF38C13000-memory.dmp

Download

memory/1968-69-0x000001CF38C40000-0x000001CF38C48000-memory.dmp

Download

memory/1968-70-0x000001CF38C70000-0x000001CF38C76000-memory.dmp

Download

memory/1968-71-0x000001CF38C80000-0x000001CF38C8A000-memory.dmp

Download

memory/1968-42-0x000001CF38A90000-0x000001CF38AB2000-memory.dmp

Download

memory/1968-61-0x000001CF38C50000-0x000001CF38C6C000-memory.dmp

Download

memory/1968-56-0x000001CF38B40000-0x000001CF38B5C000-memory.dmp

Download

memory/2016-165-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/2016-166-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/2016-167-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/2016-172-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/2016-169-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/2016-168-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/2052-94-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2052-95-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2220-37-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2220-36-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2280-59-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2280-49-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2344-33-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2344-31-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2432-65-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/2432-68-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/3944-181-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-178-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-179-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-177-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-176-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-174-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-175-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-173-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-185-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-186-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-187-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-182-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-183-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-184-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3944-180-0x0000015441100000-0x0000015441120000-memory.dmp

Download

memory/3944-188-0x0000000140000000-0x00000001408B4000-memory.dmp

Download

memory/3968-38-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/3968-39-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/3968-189-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/3968-96-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/3968-21-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/3968-218-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/4176-125-0x000001C4CE8C0000-0x000001C4CE973000-memory.dmp

Download

memory/4244-210-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/4440-138-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/4664-206-0x0000000000BF0000-0x0000000001847000-memory.dmp

Download

memory/4800-0-0x0000000000200000-0x000000000152C000-memory.dmp

Download

memory/4800-1-0x0000000003600000-0x0000000003610000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads