salatstealer | 114eb929add68c826dbcf62c29da6f0d949ef5c575510d4ca1151686c455c8a5

Analysis

max time kernel
42s
max time network
56s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 64.8MB
Sample260801-bsvvdatzhv
SHA256 114eb929add68c826dbcf62c29da6f0d949ef5c575510d4ca1151686c455c8a5
MD5 8922c232c4efd191ccc6da6532a4d270
SHA1 f77b348168a5638ab26abeab72aad09c9f07a31b
SHA512 cafce0ef6d1cf419a2a46479799667988178451a9054b263be5f124d4a606d411584029b6ab04c669bf7aa90b1954b4b718898455428d6eb16efe31b211cb0b8
SSDEEP 1572864:wxuHzOk7I++xDwPpbC8GnhRDhZ7Lgxuow1Scrbp:wxuTF+2xbC7V9gjQp
TLSH
T10BE7330E55ED19A5D477EA3E0EB0A706C673BE2AC724C9D71D7843218EA70B04D2B7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer xbinder loader persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Extracted

Family

xbinder

Mutex

Svi7sj4dYFDhXOL9u

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
WardenTool.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
Warden.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp	family_salatstealer
behavioral2/memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp	family_salatstealer
behavioral2/memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp	family_salatstealer
behavioral2/memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs

resource	yara_rule
behavioral2/memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral2/memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5db-43.dat	UPX
behavioral2/memory/4640-47-0x0000000000D20000-0x0000000001976000-memory.dmp	UPX
behavioral2/memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp	UPX
behavioral2/memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp	UPX
behavioral2/memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp	UPX
behavioral2/memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2532	powershell.exe
4540	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 9 IoCs

pid	Process
3184	input.exe
4640	WardenTool.exe
3228	Warden.exe
3748	Warden.exe
5584	Cryptor.dll
4484	Cryptor.dll
1868	1.exe
4244	stealer.exe
1980	stealer.exe

Loads dropped DLL 63 IoCs

pid	Process
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3748	Warden.exe
3748	Warden.exe
3748	Warden.exe
3748	Warden.exe
3748	Warden.exe
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
4484	Cryptor.dll
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
12	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2996	powercfg.exe
4616	powercfg.exe
728	powercfg.exe
3180	powercfg.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5db-43.dat	upx
behavioral2/memory/4640-47-0x0000000000D20000-0x0000000001976000-memory.dmp	upx
behavioral2/memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp	upx
behavioral2/memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp	upx
behavioral2/memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp	upx
behavioral2/memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4208	sc.exe
716	sc.exe
3404	sc.exe
3100	sc.exe
5924	sc.exe
6040	sc.exe
1212	sc.exe
3592	sc.exe
6080	sc.exe
4520	sc.exe
4572	sc.exe
1520	sc.exe
3596	sc.exe
4280	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c5dc-52.dat	pyinstaller
behavioral2/files/0x000c00000001c5da-83.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4500	cmd.exe
3136	cmd.exe
4784	cmd.exe
3008	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WardenTool.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3136	cmd.exe
4744	netsh.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1980	stealer.exe
1868	1.exe
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	stealer.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeIncreaseQuotaPrivilege	2532	powershell.exe
Token: SeSecurityPrivilege	2532	powershell.exe
Token: SeTakeOwnershipPrivilege	2532	powershell.exe
Token: SeLoadDriverPrivilege	2532	powershell.exe
Token: SeSystemProfilePrivilege	2532	powershell.exe
Token: SeSystemtimePrivilege	2532	powershell.exe
Token: SeProfSingleProcessPrivilege	2532	powershell.exe
Token: SeIncBasePriorityPrivilege	2532	powershell.exe
Token: SeCreatePagefilePrivilege	2532	powershell.exe
Token: SeBackupPrivilege	2532	powershell.exe
Token: SeRestorePrivilege	2532	powershell.exe
Token: SeShutdownPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeSystemEnvironmentPrivilege	2532	powershell.exe
Token: SeRemoteShutdownPrivilege	2532	powershell.exe
Token: SeUndockPrivilege	2532	powershell.exe
Token: SeManageVolumePrivilege	2532	powershell.exe
Token: 33	2532	powershell.exe
Token: 34	2532	powershell.exe
Token: 35	2532	powershell.exe
Token: 36	2532	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2768	4788	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 2768 wrote to memory of 2848	2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2848 wrote to memory of 1240	2848	calc.exe	90
PID 2768 wrote to memory of 3184	2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 3184 wrote to memory of 4640	3184	input.exe	92
PID 3184 wrote to memory of 3228	3184	input.exe	93
PID 3228 wrote to memory of 3748	3228	Warden.exe	95
PID 3748 wrote to memory of 4500	3748	Warden.exe	96
PID 2768 wrote to memory of 5584	2768	2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 5584 wrote to memory of 4484	5584	Cryptor.dll	99
PID 4484 wrote to memory of 2664	4484	Cryptor.dll	101
PID 2664 wrote to memory of 5372	2664	calc.exe	102
PID 4484 wrote to memory of 1868	4484	Cryptor.dll	103
PID 4484 wrote to memory of 4244	4484	Cryptor.dll	104
PID 4244 wrote to memory of 1980	4244	stealer.exe	106
PID 1980 wrote to memory of 3136	1980	stealer.exe	108
PID 3136 wrote to memory of 4744	3136	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_8922c232c4efd191ccc6da6532a4d270_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SYSTEM32\calc.exe
    calc.exe
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1240
- - C:\Users\Admin\AppData\Local\Temp\tmpbxzeu3uc\input.exe
    C:\Users\Admin\AppData\Local\Temp\tmpbxzeu3uc\input.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\WardenTool.exe
      "C:\Users\Admin\AppData\Local\Temp\WardenTool.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Warden.exe
      "C:\Users\Admin\AppData\Local\Temp\Warden.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Warden.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Warden.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        Executes a command shell one-liner
        
        PID:4500
- - C:\Users\Admin\AppData\Local\Temp\tmprg0dyqb4\Cryptor.dll
    C:\Users\Admin\AppData\Local\Temp\tmprg0dyqb4\Cryptor.dll
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\tmprg0dyqb4\Cryptor.dll
      C:\Users\Admin\AppData\Local\Temp\tmprg0dyqb4\Cryptor.dll
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Windows\SYSTEM32\calc.exe
        
        calc.exe
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Windows\System32\win32calc.exe
        
        "C:\Windows\System32\win32calc.exe"
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\tmpzc2rpb1h\1.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpzc2rpb1h\1.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1868
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Executes a command shell one-liner
        
        PID:4784
        
        C:\Windows\System32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:4188
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:6040
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:1520
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1212
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3596
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:4280
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:2996
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:4616
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:3180
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:728
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:5780
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "NUXCTTKD"
        6⤵
        Launches sc.exe
        
        PID:4208
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "NUXCTTKD" binpath= "C:\ProgramData\yjwwbpjfgyjw\sletikpcfccn.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:716
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:3404
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "NUXCTTKD"
        6⤵
        Launches sc.exe
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\tmpu954yez8\stealer.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpu954yez8\stealer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\tmpu954yez8\stealer.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpu954yez8\stealer.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4744

C:\ProgramData\yjwwbpjfgyjw\sletikpcfccn.exe
C:\ProgramData\yjwwbpjfgyjw\sletikpcfccn.exe
1⤵
PID:2064
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5368
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5924
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3592
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6080
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4520
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4572
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Warden.exe

Path C:\Users\Admin\AppData\Local\Temp\Warden.exe
Size 8.0MB
SHA256 67a05f7147833e1440883945c3ff655daf93d40da38a244a4f0e1adb75b37ef2
MD5 c70c3faf511931107678fc0cf2ba6739
SHA1 ceace2df785a578fd8d2d41560e3b7f2c8c6bee2
SHA512 374d34b23ec6d3d9ea705aad150245af693efa9f7a914fe66fb4174ded302be74b0416178f515f3b5f08c1c5e1ca2e8bf4fbed86d3b8558ad908ec683fe8c862
SSDEEP 196608:zfQfOtbW897G6x7eovq5XMP6PzFcssHsoq1bRjMFn:sW1bdq1B7LsHsoq1bpin
TLSH
T16886334552D105E6E8E7E13D5EA2E1A2C271B8241722C5DF07E08B6B3F572F26D3AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WardenTool.exe

Path C:\Users\Admin\AppData\Local\Temp\WardenTool.exe
Size 3.4MB
SHA256 5a1fceadbeb3f6cbb8dfba5f58efe9536cb7ff1b56c29a3fa785e1c284236acd
MD5 1a2daaaa74bfabf86bcecd88b41352e3
SHA1 d0d1f889ba5b9de65841b037d2eb48bcc19d99de
SHA512 99aef5fefceabc3844828fb461947b15ffc04443fde543e28d66515ad7325993ba9cc3e9192040d77b3e9872ee3ef4207ad666ddf2bdf7200ce5524d660f5149
SSDEEP 49152:zIJbxKLD7sq1b46j4Z67d0I8jEC/6L0mQ811Qr6X7pmNjcnpHk5W/Ersc1Ws+De:sJg/7sq1U6Egsyonw+ScjcFk5WovR
TLSH
T193F533E1D4F45085D5E540FE3D0D5C5C71001C729AE6BB921873BEACE69E8A08B2EBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32282\base_library.zip
Size 1.3MB
SHA256 3acb1ca3b427206b12dce9371366c916f2d4e2c75a3a563ff0b7bb1d70bdc147
MD5 2ceaa2c0bd0d113ecfeb045c1df6e266
SHA1 a5ed1bc843bb5ec3b8992227cab170a9939b672a
SHA512 5a62b218674bdabc09389a92635290b514db0e526b4e4ee6568ec06f905a909bda42e3cffc9f57bb94c4858e2104f597610c6a8efaef63130d7c5ec008fff015
SSDEEP 24576:DuUFskxLQ3wRpheGlbUdxQeOdP2m2dfvio:DuUFJ+3wR8dx/r
TLSH
T174552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_ctypes.pyd
Size 139KB
SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
MD5 03fb3055ed0c56155bbf030596726e03
SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
TLSH
T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\base_library.zip
Size 1.3MB
SHA256 d5b61c3506479c7667365dd0eb2547cd6d288937d00eb0277d2d38e1ffa4361e
MD5 9e3a9f5e0148fadd16ac8d9eb2847af1
SHA1 e62f5d982b7833e1cf97d675c9bdd13b44f59cae
SHA512 6f75dc86a65f6b3e5b6c339988a6bc97b3f2f1fa9fc81a214794056e5655e31d4227b37c646059144b6252e59857d4ed98f89231f2ee950057ad41b8147b986a
SSDEEP 24576:YLr5xXd8lb63jRpPiuUFeQeOdP2m2dfjoU:4dz3jRpiuUFe/N
TLSH
T1DE552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_hashlib.pyd
Size 68KB
SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
MD5 9ec1021fa8a3c252e1f805ac7f172753
SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
TLSH
T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_queue.pyd
Size 33KB
SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
MD5 8fc4810cff733e6f17a7530d3fb67d58
SHA1 20163031892c87a67169f4ae25115e4e33845626
SHA512 c45ebdb450f30d034ba113729ada2a006baa2ad8c7a83cc59ee55e6fd10511d6f663b1d7f24fbcd493884a84cbedd1368e3a2136ff7da58fb47394147b021f45
SSDEEP 768:BFJpl1r6rWcgds5Iy9UxLXyrcEOJh2Ip48XlCxf1ml0ZMz7:BDr8Wcgds5Iy9Uxyrcz89ayfIbz7
TLSH
T10AF28ECAAA684047D663C671C1E7EF42F974F7D34A11879F2169828E1F23381F726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_socket.pyd
Size 84KB
SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
MD5 c2938dbdcdaba1ccbefee37f6a06cd0c
SHA1 944cb024144f327ba517ccf72af9bb9a79b8b23e
SHA512 79e9f40665b7049c9feb04742a91c8c88749c1998794f1a51ac7b47a5f5ac3c1a2b441dcb9cd126e395581d9553305c24356b54d81d0a9fbecb41a4341af776f
SSDEEP 1536:axl/h+6SDo3OkB+ecI4xyJwoQlyJ+9+nzpjTOKxtS44O05IyywFyrcz89jfIW44a:axko35X4yJwoQlyJs+nzlqKxBw5IyywZ
TLSH
T154836B10A69041FAEB63D1B5C2639E63FBB4B5C11391A35F0066C55A1F333C2BF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\_wmi.pyd
Size 39KB
SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
MD5 609206d81f38626f1c022d1a0ff1466b
SHA1 cef724eceae7995d425c169912e292ac43572ed7
SHA512 e973f30ee976b580913f3a5c2d762364897054f958fb26236eeccd17832cce0bfa1bc04c0981d221c0536f5c9b1d21551ec12a873cbae64fc6b50634dc9d0166
SSDEEP 768:ZEpKg2a5YDQy1ZuNccibJlIyLiMXyrcEOJh2Ip47YCxf1mlPrY0Bb:ZEkg2KY3UNccitlIyLiWyrcz891fITYW
TLSH
T16C038D89E7644052E663DB75C9A2DE43F875B7D35B11938F326482980F233C1E73A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\base_library.zip
Size 1.3MB
SHA256 4908e7fa6ef45ce467f71b155c0fd8fd60c1666e7c8e90f624182cd0b0718ea3
MD5 85aee0f8c89313a203a2abc85867f12f
SHA1 9b77cdd3b5969c9ab094b8daef941c353569f242
SHA512 38ab187d4502a67ade37809aa0d8a80fe9c38701f1e4f94d6e9df849a19a293f8f6ff93ee4c2a68dbec6b43e16cbc36bd120b5a0fdb21086e4473c415dc5c4a7
SSDEEP 12288:DtYzGNcT1pGkW7WpHfqhTswtyuOBa80201jwCVRDVoioSYBZRn6Ni6djdTtKi2cK:eSeT1W7Wp/qi5zAdZ45cPPdxhYLs8
TLSH
T11D550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\python3.dll
Size 70KB
SHA256 85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b
MD5 c947a886e61ad18d052840e095aaa5fc
SHA1 4a2d0092e50757e0b951565c02dd541ab48da96e
SHA512 d4b3d769fa4c22e914e12ac8b63263bacda72b351bea5bd53ba1d0fd6a6c57c98fc392645170f26e7c84fdf855fbe587615f4f3b1f150285420f5b26bda2da0a
SSDEEP 1536:LotssyKcunV8PT5Iyy00yrcz89YfIZRSjB:MtssyKQ5Iyy0AcZoB
TLSH
T120634CC25B5BF8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI55842\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

input.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpbxzeu3uc\input.exe
Size 11.3MB
SHA256 efe6ec40e0c9b510f84da4c5706119dbed3063b31ec19f7d557a4c9e89c2c7a0
MD5 58b9a477d5a7a0fea9f27bd4d439619f
SHA1 6bf0301903992201bf24003ff0ac7a8b5135fad4
SHA512 9aad56630adf28f5da8fed9c2075878761bffbe93b6f1843f5b3dcf84f8b124d80d1c0f366570651e914d229a5aa4ee43e4d94b3657471fbdb1054803088f4a5
SSDEEP 196608:5pYLNOF5u4BgLRFh4FJwNKosNm7tDnpa6vsuY5VLCBLIAHLGLzc0e0SU:WNOdaLzIwcY7tDU6vsuY5BELVLmzdn
TLSH
T1A8C633A180F18952E5D9E0FF3D5D9C8C9040193478935A6B0E61ABECA29F1F74E32EF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptor.dll

Path C:\Users\Admin\AppData\Local\Temp\tmprg0dyqb4\Cryptor.dll
Size 43.8MB
SHA256 0fb10f361287df0571b89ab59d58efb3dd73fdf70d451e71e351cde354bfb3c2
MD5 93e76760a1172e41bfe2d8c186f12e4d
SHA1 9a3247e934bc4f455fbf37c04af84e7818eabdfb
SHA512 fbedce4485dee6ba284f983ab63e271110275dc24cd0b2f64208eea4c09d8ad80ee10c0289c4969855c01fde4df4d1a0121bea9b06431cafd67b657382fd7dd6
SSDEEP 786432:rN/ZMswHzXaRMloKBuVPfYomyxIuAba52/F7DQ5RoJxR8fzbWlA68VC2vV/M8+d8:r9ZSjaR1KsVHdsbVN7fkzbWm6eCD8+dn
TLSH
T1B3A73310BBA51659FBC9CC3D807DC12796B870760B62DADB47F296395F0B1F02C2A2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bgpo3ihy.hwk.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_bgpo3ihy.hwk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-258-0x0000012923920000-0x00000129239D2000-memory.dmp

Download

memory/2532-254-0x000001290B200000-0x000001290B222000-memory.dmp

Download

memory/2532-257-0x000001290B2B0000-0x000001290B2CE000-memory.dmp

Download

memory/2532-259-0x00000129239E0000-0x00000129239EA000-memory.dmp

Download

memory/3184-37-0x0000000000C70000-0x00000000017BC000-memory.dmp

Download

memory/4540-273-0x0000019AEE310000-0x0000019AEE3C2000-memory.dmp

Download

memory/4640-47-0x0000000000D20000-0x0000000001976000-memory.dmp

Download

memory/4640-243-0x0000000000D20000-0x0000000001976000-memory.dmp

Download

memory/4640-268-0x0000000000D20000-0x0000000001976000-memory.dmp

Download

memory/4640-242-0x0000000000D20000-0x0000000001976000-memory.dmp

Download

memory/4640-168-0x0000000000D20000-0x0000000001976000-memory.dmp

Download

memory/5780-263-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5780-265-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5780-264-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5780-262-0x0000000140000000-0x000000014002B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads