5e33d1bc76338bcec8cd570739af5b6cb37aaefa5bcad6537301d47580e70189

Analysis

max time kernel
151s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
Size 139.8MB
Sample260712-tardcaev8x
SHA256 5e33d1bc76338bcec8cd570739af5b6cb37aaefa5bcad6537301d47580e70189
MD5 e73be71f2ace8639ef817a1dca0e111d
SHA1 dad370bd847c1fbb0a3a7ea2322eccceb5f9f9c0
SHA512 304ce27dbb7ccfc2f05d742819b4e656ffff63e8bc1dc9dfd164a5594a5f483adcd96ebba2044b33c998b35fcf92159e00fa6b33b38d713c3465c6cc2385e26b
SSDEEP 786432:PBdSr/5RVvsZXCZMeQ6mtYptgPV1OINWtzUiV6xdUKit4XFe2vuxTLd3:PBdSL5jsZXoQzNWtzUiVynXFelTLd3
TLSH
T177689D0177F6A563D167917946AFA002BB31B0032734DAC7366C8364AF53FE46EBAB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com
1	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4132	powershell.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
580	taskkill.exe
3616	taskkill.exe
3120	taskkill.exe
2492	taskkill.exe
4584	taskkill.exe
1708	taskkill.exe
2724	taskkill.exe
1800	taskkill.exe
5076	taskkill.exe
6076	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4132	powershell.exe
4132	powershell.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	6076	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
Token: SeDebugPrivilege	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	580	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1140	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	88
PID 1140 wrote to memory of 4132	1140	cmd.exe	89
PID 4132 wrote to memory of 6024	4132	powershell.exe	90
PID 6024 wrote to memory of 5748	6024	csc.exe	91
PID 1240 wrote to memory of 1892	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	92
PID 1892 wrote to memory of 2292	1892	cmd.exe	93
PID 2292 wrote to memory of 2428	2292	net.exe	94
PID 1240 wrote to memory of 2800	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	95
PID 1240 wrote to memory of 4608	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	96
PID 1240 wrote to memory of 2888	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	97
PID 1240 wrote to memory of 3512	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	98
PID 1240 wrote to memory of 1564	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	99
PID 1240 wrote to memory of 1336	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	100
PID 2888 wrote to memory of 1708	2888	cmd.exe	101
PID 3512 wrote to memory of 4584	3512	cmd.exe	102
PID 1564 wrote to memory of 2492	1564	cmd.exe	103
PID 2800 wrote to memory of 6076	2800	cmd.exe	104
PID 4608 wrote to memory of 3120	4608	cmd.exe	105
PID 1336 wrote to memory of 3616	1336	cmd.exe	106
PID 1240 wrote to memory of 724	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	108
PID 1240 wrote to memory of 5616	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	109
PID 1240 wrote to memory of 6016	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	110
PID 1240 wrote to memory of 4944	1240	2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe	111
PID 6016 wrote to memory of 5076	6016	cmd.exe	112
PID 4944 wrote to memory of 1800	4944	cmd.exe	113
PID 5616 wrote to memory of 2724	5616	cmd.exe	114
PID 724 wrote to memory of 580	724	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_e73be71f2ace8639ef817a1dca0e111d_avaddon_blankgrabber_coinminer_glassworm_icedid_luca-ste.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v0jgd1uo\v0jgd1uo.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6024
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1851.tmp" "c:\Users\Admin\AppData\Local\Temp\v0jgd1uo\CSC290CCCBA70D147C7BB4BFEF05945F5BD.TMP"
        5⤵
        
        PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1851.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1851.tmp
Size 1KB
SHA256 f0a580808d0066c824e9aa452fb2fab53e1a8548c27c1543d8b9f9801fa9e1a8
MD5 698b35da57e9b748a22fcfe1fbdad69c
SHA1 0a4efdcbe0b1b822f4360ec1f3a017bf9c59c80c
SHA512 40f4e96b411766cca05bc9fe48208c2a0ac9583e58a62bae8d64f6fc0be8b871c6360b2fc7a9c6947928821cb35ba45d41107d68f76672598a03cc73b21ff549
TLSH
T10A21CC0553F9470FF073473169FA572F9275FD95EFA1939A844042182C51504DEA0BB3
MD5 SHA1 SHA512 TLSH

Submit Download

v0jgd1uo.dll

Path C:\Users\Admin\AppData\Local\Temp\v0jgd1uo\v0jgd1uo.dll
Size 3KB
SHA256 d907a61a3e9b52af636ae9708362a135193e2a8d4c82abd612ce8f365f2e3f3e
MD5 700ca87930332330c9ca4dfc64de3107
SHA1 db7be50cea43e15035b418b34b0ba9456bdcc0b3
SHA512 41bfc766c3536f6ab6e5e20e0bd1ef6975304c1034d0f03ff5d2f17c946de14283338df2fcf9c92b0735764109ae3903d2ffadc24814cc3c3c78b763a71a40c9
TLSH
T1CE51A727A3E8462BE4770730ADF3472637B9FC609B72675E49804328ACA53645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC290CCCBA70D147C7BB4BFEF05945F5BD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\v0jgd1uo\CSC290CCCBA70D147C7BB4BFEF05945F5BD.TMP
Size 652B
SHA256 7cd1533ecad8487687e77e9c5b8e581da5327477aaea8f423764800c9ec40408
MD5 df4f86b430d9f81184897b5083009c16
SHA1 f0f41437b0455a007bb951926f8b3ff2ea4312d7
SHA512 88bf6b39c1c4771e2b04f248da53a10f96088d76d52163411adff9a959f5f0189f0f7ed10b81bd9768af3b592525ff240cc352ede7943ba395e9358cefcb50f5
TLSH
T12EF05E0A63F8120EF0F34B30BDF6836391B9BC65DE7293ED584043192C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

v0jgd1uo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\v0jgd1uo\v0jgd1uo.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

v0jgd1uo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\v0jgd1uo\v0jgd1uo.cmdline
Size 369B
SHA256 a980baaf9aff99fc5d44e88bbda78bcb162361382681c1bafb0449ad0c73b6f1
MD5 2383afe91fbdfe9e819944c7c1ca3bb0
SHA1 89b89309f7ab1b4eb7e950ccd22310ccf193e94c
SHA512 32822ac829f72f806157cba8ca4488c8433c1721ef748a7988f45e6d4ac150303a4ac6ccab364bf3f028f556a3913a08679ab4068370c9ba6020c1649c6a215e
TLSH
T1DCE0683A638AC67E86FA501B2169C5BCA2730A4B2E403FC45040480DD4570002FD1B82
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4132-786-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-802-0x0000012A8EF00000-0x0000012A8EF08000-memory.dmp

Download

memory/4132-787-0x0000012AA7BF0000-0x0000012AA7DB2000-memory.dmp

Download

memory/4132-788-0x0000012AA82F0000-0x0000012AA8818000-memory.dmp

Download

memory/4132-784-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-783-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-796-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-785-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-804-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-782-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-805-0x0000012AA75E0000-0x0000012AA770F000-memory.dmp

Download

memory/4132-806-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download

memory/4132-781-0x0000012A8EF70000-0x0000012A8EF92000-memory.dmp

Download

memory/4132-778-0x00007FFCCC3FF000-0x00007FFCCC400000-memory.dmp

Download

memory/4132-808-0x00007FFCCC270000-0x00007FFCCCC14000-memory.dmp

Download