f1006c06d7ffd4f8236c3a95f857dcb148759872aefaeca14c0982a0037618e9

Resubmissions

10/08/2026, 12:19

260810-phay4sgr9z

10/08/2026, 12:10

260810-pb8a2agq9w7

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Phosgene.exe
Size 22.5MB
Sample260810-pb8a2agq9w
SHA256 f1006c06d7ffd4f8236c3a95f857dcb148759872aefaeca14c0982a0037618e9
MD5 82a68e4f2dc296cda66a1666d964a72f
SHA1 4ed8a8ab682df89804e1ad9568dab77f6f930ebc
SHA512 58330bcf84c57f7edc0ffcf8d11689c857ee52d41df1c7b5d39f86dcb9d6bdd6a8390811014aea8dc402a10f9ed74ce5681c77c44004a7b200850bb363605732
SSDEEP 393216:d4jQCZ7YlG8Lsbi8odADHSuWtytsAoHwdykbSTgfNQShdyXiv42ILxs0a9LcrIGi:KQCZ6LsbIdAjHCytsAB/J+G42ILaJ9L7
TLSH
T1B937339EE9EC00B2DCD4167293D789B8E47853163544E41FAB6E1C540DE23A91A3FBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
2500	MBR.exe
2584	1.exe
3404	BitBlt1.exe
3144	MBR.exe
3836	ATohou.exe
3700	circle.exe
4928	AWave.exe
5404	rgb.exe
4776	sinewaves.exe
4884	bytebeat1.exe
5012	invmelter.exe
5460	BitBlt1.exe
1008	tunnel.exe
1468	crazysound6.exe
4592	ALast.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\232E.tmp\\MBR.exe"	MBR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\232E.tmp\\MBR.exe"	MBR.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBR.exe
File opened for modification	\??\PhysicalDrive0	MBR.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4248	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitBlt1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	invmelter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tunnel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crazysound6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phosgene.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATohou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytebeat1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	circle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sinewaves.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
2528	taskkill.exe
4472	taskkill.exe
3868	taskkill.exe
6056	taskkill.exe
2956	taskkill.exe
948	taskkill.exe
6104	taskkill.exe
1256	taskkill.exe
4816	taskkill.exe
5152	taskkill.exe
4996	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3852	schtasks.exe
1908	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: 33	2460	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2460	AUDIODG.EXE
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	3868	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	5152	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	4996	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4248	4844	Phosgene.exe	89
PID 4248 wrote to memory of 2500	4248	wscript.exe	90
PID 4248 wrote to memory of 2584	4248	wscript.exe	91
PID 2500 wrote to memory of 3852	2500	MBR.exe	92
PID 4248 wrote to memory of 3404	4248	wscript.exe	94
PID 3144 wrote to memory of 1908	3144	MBR.exe	98
PID 4248 wrote to memory of 1256	4248	wscript.exe	101
PID 4248 wrote to memory of 4816	4248	wscript.exe	103
PID 4248 wrote to memory of 3836	4248	wscript.exe	106
PID 4248 wrote to memory of 3700	4248	wscript.exe	107
PID 4248 wrote to memory of 2528	4248	wscript.exe	108
PID 4248 wrote to memory of 4928	4248	wscript.exe	110
PID 4248 wrote to memory of 5404	4248	wscript.exe	111
PID 4248 wrote to memory of 4776	4248	wscript.exe	112
PID 4248 wrote to memory of 4472	4248	wscript.exe	113
PID 4248 wrote to memory of 3868	4248	wscript.exe	115
PID 4248 wrote to memory of 6056	4248	wscript.exe	117
PID 4248 wrote to memory of 5152	4248	wscript.exe	119
PID 4248 wrote to memory of 4884	4248	wscript.exe	121
PID 4248 wrote to memory of 5012	4248	wscript.exe	122
PID 4248 wrote to memory of 5460	4248	wscript.exe	123
PID 4248 wrote to memory of 2956	4248	wscript.exe	124
PID 4248 wrote to memory of 4996	4248	wscript.exe	126
PID 4248 wrote to memory of 1008	4248	wscript.exe	128
PID 4248 wrote to memory of 1468	4248	wscript.exe	129
PID 4248 wrote to memory of 948	4248	wscript.exe	130
PID 4248 wrote to memory of 6104	4248	wscript.exe	132
PID 4248 wrote to memory of 4592	4248	wscript.exe	134

C:\Users\Admin\AppData\Local\Temp\Phosgene.exe
"C:\Users\Admin\AppData\Local\Temp\Phosgene.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\232E.tmp\232F.tmp\2330.vbs //Nologo
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3852
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\BitBlt1.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\BitBlt1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3404
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im 1.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im BitBlt1.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\ATohou.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\ATohou.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\circle.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\circle.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3700
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im ATohou.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\AWave.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\AWave.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\rgb.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\rgb.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\sinewaves.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\sinewaves.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AWave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im sinewaves.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im rgb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im circle.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\bytebeat1.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\bytebeat1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\invmelter.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\invmelter.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\BitBlt1.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\BitBlt1.exe"
    3⤵
    - Executes dropped EXE
    PID:5460
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Bytebeat1.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im invmelter.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\tunnel.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\tunnel.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\crazysound6.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\crazysound6.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1468
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im crazysound6.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:948
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im tunnel.exe
    3⤵
    - Kills process with taskkill
    PID:6104
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\ALast.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\ALast.exe"
    3⤵
    - Executes dropped EXE
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\232E.tmp\PatBlt.exe
    "C:\Users\Admin\AppData\Local\Temp\232E.tmp\PatBlt.exe"
    3⤵
    PID:3776

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe
C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\1.exe
Size 11KB
SHA256 94aa578b5c5fe98f2f8e81705fff8addab6f2f4c2749778ef942b1cfab5b6aa8
MD5 a14ba46ecdc37d9e73efd734b0ab4db9
SHA1 9e72f4b89d2643110b2e3efc80c14222a5e00014
SHA512 432bbda373fb97bef1a1a8a7292eb85f70cb7866741bf000d5775a6a9a261124ab24b3e053a6f4726a5b3e48d5c5de4f86deb24ea25265dd0945b9740156268b
SSDEEP 192:+H5S6RXKv6ZN4sr5TT/oOlA4R9MnX6fT7UPs:aR6C5TTRLeXo4s
TLSH
T18732F82AD243AD72FC3BD4F404FBEBB55E73F9514D29483ACFA0FD851A225A47406209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.wav

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\1.wav
Size 469KB
SHA256 05d210f77850ccc5963bc3a3cd917b9376224ba5966592fe3b7d8d324a4d461e
MD5 c8731b54ea734527e6f466471cc9918b
SHA1 33ffcc8daf64870dcdf68dacbd7d5b6e4df14aa7
SHA512 8d0cae3723b5a290fd402018e4bf4cf965e033f7abdd9c960e828ff8f92be31ecb9caf35de43c58cbc1bf008c0d4fb1d19e51747c3027007cdce123a60e3aa68
SSDEEP 6144:IMjgHuFrWNAGWvdxRCmX7BOoFhOYs7OsN70axLIbYrSL/7xe9JKQAqT/IUQS0yMl:m8J0MvTlXS4BRvAMXnV
TLSH
T1FEA40AB6A0FA285B094F8839E20C9F7DFB425CE4152CE1955A24FD8B613AB44CDF1763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2330.vbs

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\232F.tmp\2330.vbs
Size 4KB
SHA256 6a28763270d05101696698bb1436132dc0191928b0ea9ed587cd6c6a17299ced
MD5 e7f75ac3c787776c5a461fe7c13e7cb0
SHA1 de59fc246d74e141ada6d1567069f8d08b3fb69f
SHA512 169ca358f8be0ffcd556b76e1d2741c7813cd5bc06e6bab833e702d7cd60c239373f1a363058434b590d8604d0c020df1b2280d1c51da6276f55a9cf9ac9408e
SSDEEP 96:jxU1BY1QN3n2wzDaPbPS6PpxtYYALm9tV7apzG:C1BY1QN3n2wzDaPbPS6PpxtYYALm9tVl
TLSH
T1AFA100166BC20714B2F26F593CB1056A4E17BF61E53AE75C1D482E0E1EB394C8CA8F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ALast.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\ALast.exe
Size 11KB
SHA256 626a05e274092f001752285099fbc5581f2beaaebdcbd8ea7947b3956fc23dea
MD5 8f25dbd19b38c18d85625ee1e62665b7
SHA1 8a00a0fcbcdde34aed502e75a349421b963c7364
SHA512 6c2afd410e16ee71383acd56eef72991d9098ff3ac12ff9982238e6d3413e9bc84f86ff25df7ec4915fdfc2a8301b8e66b49118ea8787cbd7380ffd814db044a
SSDEEP 192:t+H5SSRXKv6ZN4sjxr5N/omlA4R9Mnx6fT7UPs:taZ66xr5N5Lexo4s
TLSH
T19532F91AE243BD72F92BC4F404FBEBB59E73F9514D29483ACFB0FD855A215A47406209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ATohou.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\ATohou.exe
Size 11KB
SHA256 5028f3b3e63609038404bf6e3c2dbc360892312d85aa11e83489f381f09fb99b
MD5 d7064aa7ee28f685757e7455d4e49c6a
SHA1 535d326ab1453bed0c050c8822aee9ef54c8b26e
SHA512 2a0747087ea14c664688d3453be8f40d396ca916143f0473eb1739fbe5cf1f19a451359d1e8713fe19b3bdda21eaea20a8294b23c0d99dd793818e85b83c28f8
SSDEEP 192:BH5SmRXKv6ZN4p2v1Hr/oClA4R9Mno6fT7UPs:JV6L61HrtLeoo4s
TLSH
T151320919D243AD72F83BD4F005FBAB765D73F9514D38483ACFB0FD851A214A47406209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AWave.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\AWave.exe
Size 11KB
SHA256 afcb1f5e73785c0c5952394ca69986e9b9e86cc5fb0a4de4684903a03d9859a4
MD5 9cbf1f1e4821fa5b8962423c9b2ecf24
SHA1 7f3fd62332d10cfdb0be3452a71cd6df2d7c0602
SHA512 bee905b459259801185c55e25f8e70fa563ea8ecaa0ad300aea0379500fe683d6bc370ae3d7a0d53898443faf150a1081f23146c8e32deb6961fe955aa0003c8
SSDEEP 192:XH5SSRXKv6ZN4sjxr5N/omlA4R9Mns6fT7UPs:3Z66xr5N5Leso4s
TLSH
T19932081AE243BD72F92BC4F404FBEBB69E73F9514D29483ACFB0FD855A215A47406209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitBlt1.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\BitBlt1.exe
Size 12KB
SHA256 74c0a87bee806fc95c800370475a29e3cc6b49ac2b3c4b227234e276ad48ca40
MD5 58c9d398592a7ef26900306f7937f815
SHA1 12efb0a1ae1a35b1c0d8a62065dc615cee60e031
SHA512 25c23fe91101d20d0f4c8229b712dfbc02704bce8744849726cd3f82d3ca389df3542339d22bacbe4dd0810f65d6b3136e19d5a3c12a605a66dfd0ee143b7e43
SSDEEP 192:xH2Md+babzKr6ZN4Yjt/jAo00UV9Und6fT7UPpi:52Kt/j6+do4p
TLSH
T15D42D727E643B9B2F82BC4F404FBAB764D73F8124D25082ACFB0FE566A215B0741D619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\MBR.exe
Size 101KB
SHA256 095d1eba5b8f50305a0ad75c8b1879b872437ef7e884588944953bc63005430e
MD5 52e2c0513dc998dcb486a87dcaebd040
SHA1 fda3c535c9a9425e8e0d2f2be3584280f4d15dc9
SHA512 5ec0d3ffe423af847800186e3932460674eef8a38f887623d32e47c02aec971571dd46c0f8a157ab16a5ffe020a89ba25e40e62326081915f04de6c202a58d95
SSDEEP 3072:wCGPVHzzgd2HPVVf9AebuLFfK9s7ItOX1NgDd9:wrak9gora16
TLSH
T1E0A35B53F2C08DB3E1F22A7C9C05B694A87BBD212E2D6B5B67A80D4D1D792C1590C7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PatBlt.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\PatBlt.exe
Size 12KB
SHA256 702b15a461b6ceb74657fc720a48a56b260abbdaf36727a734db6472dcfb64b4
MD5 b269860ffcb5c1d285436f3594a153de
SHA1 b0ec9ad9ab5d3fe84fea135a05344b22100fc98e
SHA512 239afeee8678ec7670c2ddaeabe542a16a6daad5f580dbe3c52d68c3305fcab907e45e24cdab7280cb4e4a2a72f0a47b9c74b87a9e21e3eb1a6402651183096f
SSDEEP 192:YHNFTU1qS/Cx94EPt/7ToBJQh9zCS6fT7Uzn:scBet/7cS8Sosn
TLSH
T13D42B617E243ADB2F42B85F404F79B7A9E73F9124D254866CFF0FE9676218E07409609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alast.wav

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\alast.wav
Size 8.3MB
SHA256 8e6d53ac10c4d48f629ac219f313e617249843fb97280ca8cf22b641cf5cfcac
MD5 41a270c5d5dd2b238e04300b534aa674
SHA1 088dd6af4ae1b69388be3386d868e196b89a4d56
SHA512 37ec7e6a0a0730252773f5557f9484244275bc99213c2ee212c3a3375487d37714c5a51bd6aa618086619ec31b978f41bd57f327960fd36ee668e1be5ab13f1e
SSDEEP 196608:q2ilGwU/4XbyJvzqHIDLec9D2Bq97gVoU0AlHX/:q2W3U4qzqHI1DrxgjlP
TLSH
T1469633203D12F92CDDF2E771925B29F8965DCFF1366BE1AB4206FB6BB6351A40344122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atohou.wav

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\atohou.wav
Size 8.2MB
SHA256 78f352c42253ec7925b1bbca63435c8ab870d8cdadd1d3310c8a63a8b9df75ce
MD5 e432c9538dc36d32a6fbb4c96d0f1009
SHA1 b4b6e0e66dea5d561094d957245e0cfb0d2e2724
SHA512 2cb593163f2e02b9f8396f2b834a96add733fef231613eca2c5267494e8d1a15f369254bffc36731312fabf10b03b39d58fd01666469870d8660bc2bd618e4c5
SSDEEP 196608:IkoY1A5Or+jLruU39d47ZQRWDVJapsjzM:i5ruU3P6kgJapiA
TLSH
T1C796237F8E696EC5C4330FBB3AAD108580585713A01358FAB9A6DD0FC63688C7DA9357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awave.wav

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\awave.wav
Size 8.3MB
SHA256 353f8b5a6fa74bb3024ef305b9141e522861c51baddf7c433935462c76c820af
MD5 fc1ebb7aa9509a302474f733c06f5ca2
SHA1 695abe0f11be324ca3af377bc84fa2b49768e405
SHA512 cce46779c6d40100c1d885f3d7b0e1993c61dd952be7d9f41351aa70f020005f587b634d863229926a1c0dc46257f3e8a5578fe4872da3b8f3dcf8831bb0aded
SSDEEP 196608:k/YcAJOGCCh7tlBCcJIYB/kBJaIrIB6+vItlBCcJIYB/kBJaId:k/KCYJlBCWB/kBJaIrJlBCWB/kBJaId
TLSH
T19296231FCA0AD945FD3816FE6CE741CD602567C1A9EB7D6607A73E6EDA10818200F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytebeat1.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\bytebeat1.exe
Size 11KB
SHA256 b2550c129dc79287846d2fbfcbefacddf55b08a695b9bb68a462c2236b142777
MD5 18796f7ffa412c2892447329fbb3d557
SHA1 5b43658ffe823b43a68478daf7648cafd652594b
SHA512 1930f366f82ececef1e7fb80fd92668d0af23585a96a4a5eacfa13f2236868fac7b3f65db63783c5dbc480a5494cf11aaca1c71423a7563e51390f6465c19ba4
SSDEEP 192:lH5SqRXKv6ZN4MbpDT/oelA4R9MnH6fT7UPs:9h6ypDThLeHo4s
TLSH
T14F32F91AD243AD72F92BC4F404FBEBB55D73F9614D39483ACFB0FD851A215A4780621A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytebeat1.wav

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\bytebeat1.wav
Size 1.3MB
SHA256 4599f6f06c7f491a50e3c4012a83cce9f3ee13ae209189cb8964f0b6ba14614c
MD5 09d2094f56d2d38aa64eac1d90c5a554
SHA1 c6268759b1eee9fdfafa0d605d62bbbf85defbca
SHA512 4ca756a06612c281ec03dd9f064b9ddaf6756b00a5d54dee62728f5cdd7ad3d928559b9857ed2f733b8b3e842b396fed94b212ef2a384265ac623433d67010f3
SSDEEP 24576:QWLbSujLfL7L/3LbjLXzjXXjzPbxNTHzXdHHHDHHHLHHH3HHHfHHHHHHH5TjTzLa:QWLOujLfL7L/3LbjLXzjXXjzPbfTHzXy
TLSH
T1DA557C400C3E555EF432B9AE5CF59D04C36F12E58291B222887FD0AA79D7BD943ABC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

circle.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\circle.exe
Size 12KB
SHA256 b8ffde2fc69292ffa1a704a1cf977eedfc86277a61d4937245d218d22674178c
MD5 ed169e40a69cf73fd3ac59215b24063f
SHA1 32d49462e74e6c08b941d8cd530a5f3c0f3b5764
SHA512 f949a7b9b5dae91f887e7ce9bb45f7500534873d3baab5f5c2b1c31b1e185e70278ceb9d4f03f495460e0fb96399239fa678b0b4750ee870cbaa6333ab5ebb6c
SSDEEP 192:c/dH9m53Tk7mPXyB94Uft/bKoCyAn5E9s/RMTLe6fT7URt:MNmPmt/bOV5EuJMTLeo+
TLSH
T11242C657E283BDB2F92B84F444EB9B7A4D73F8124D25482ACFB0FE8639119A06409655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crazysound6.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\crazysound6.exe
Size 11KB
SHA256 a3876d26ff29a77348e93a599e39a44adf6c578ef53fb7eb3ed776a7ec18e3a4
MD5 eab104af67d9e8869e75ce838dc7350d
SHA1 3a2896283c4940a6f7dba9cd4007beb0bf582777
SHA512 2b3b81b7da18b19ef3062894340b12ead012895b0a1d4d9cd18b683517af02b4b6e69af5ed4c7ec2114bca79b696fe9e40769665a895d1cc293d73b3ee1974dc
SSDEEP 192:czHZB29anKEt4JpfkvNf7voDQZ9FBPphy6fT7UhO:cjbNf7Z/BioWO
TLSH
T178320816E243BDB2F92BC8F404FBEB755E73F9610D25487ACFE0FE911A115A47415209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crazysound6.wav

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\crazysound6.wav
Size 1.5MB
SHA256 b1caa9f802ba3285d6c33285cd37085e223e1f8f0e1b32cd4e361b59a90c30bf
MD5 b96fcfa8f57bd6da0d5ceaf43dfcbcac
SHA1 b2a1260da2decaf9290ceabe1ce2d97d9264702a
SHA512 6749bc0e99ff4770ac6cd7a8c1b451da1bd30e1ef8d5a6786d96c46c555b097fdf7156529104426dd4b180b6bd64dd717d9b78d2320c898f28219b9d70892025
SSDEEP 49152:pDJUHo/O2Mu5reDhemtHpYeWfvg2Y/U/4sgex:Z3DT5rU4TvXY/U/4sgex
TLSH
T1687523117554DA03C2FD4EBB9CFA8D5C1117E00909BF5E4D0ECF7F9A808A096B6AA778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invmelter.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\invmelter.exe
Size 11KB
SHA256 2523260782044f3b939ecf20b3e3ef7f80f294f4d9e8598c8b43d06e946fc991
MD5 dbf55d00677cadc61d5bae56af5845d8
SHA1 d5fc034f4a733735d0326f330f65836866593c37
SHA512 4e04316d19326329f5ee4ede27697981e49b6ca7cc05a598738ea0c9122c2783b1f75a29e35b2d4ec0ccffb0dd6aeefd04fa645d1a9cec96be9ab1060a8bd25f
SSDEEP 192:PIHK2hjLG7mzXyB94Yjt/j3o7US9U/R6fT7URJQ:EK4QmzWt/jm+Zo+J
TLSH
T18C32D717E243B972F92BC4F804F7ABB54E73F9124D24083ACFB0FE5526215A0741D649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rgb.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\rgb.exe
Size 12KB
SHA256 f8e86c5e82e1ac0fcf8f3e3ca9641328467498c78eb94871636f28207307c444
MD5 e1e4cbd632d09bf06abc142d0faeda01
SHA1 9093678c2eebd9bbef1020e3d1938af9b811aaeb
SHA512 83889d5f432b4ac87cee2479d9d8771097ed3c7b18e5812dcff3cc917d9e74512a41018567261b62612b2e3bbb71615852d85e6584528d675aa3ffbd5d8f1acf
SSDEEP 192:CcHK2fNjP0elK1H7m+XyB94g/t/DUoN1Ym9M/4i6fy7URJi:7PlNIhm+6t/DP5eQif+J
TLSH
T10042E71BE543BDB2E92785F440FBABBA8D73F9524D204466CFB0FE462A119E0740D728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sinewaves.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\sinewaves.exe
Size 12KB
SHA256 41e371134d1a1c66269799626dbbbb450574ed7d66ed5fca44e0a2cf545ea592
MD5 29a5cc329c38836e8775581d87408451
SHA1 e817a5b615aa0cf00c3148834b3ae8d10630e1c4
SHA512 6613fb9455cb8d83f9ecdfe5554663ea0b73271ff613fb21b3c5a9e50654f35ef48ae7b24667623fb19b9f613dc07dc9c7b51b497793d44c727985ecdebfb891
SSDEEP 192:K/cZH9HugVGtsDJFxeejn1jLpoD0K9dosTa6fT7XLPK:5HU+d1jLojxTaobK
TLSH
T1DF42E717E143BD72F82B84F440FBEFB98E73F9124D254466CEB0FE8269119A17419B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tunnel.exe

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp\tunnel.exe
Size 11KB
SHA256 708b684e4882968e341afc7db4a112cbe228493e4253aefb8cd8d79aeb74c178
MD5 ac0995d40bb101186a9c2d97ae999b0a
SHA1 71264bac52c5b2db1441a82bae7aefdb2f9e1933
SHA512 6c99b46ab1b49010a8a05daac35da1d0e076b6a49b9253111307b107997a7ce713ba83641bc3fbc8a3739f7819aaffe80c9dd356bdf8017f26470b14ad8dc7f4
SSDEEP 192:HDHZBPQ6r+cKH6ZN4E/t/b/oQYgZ9sn06fT7UPJ:zgN2t/bZu0o4J
TLSH
T12732D627E243B972F92BC0F804F7E7B54E73F8524D25483ACEB0FE9539225A47819619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-114-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1468-115-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2500-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2584-56-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3144-55-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3404-57-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3700-68-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3836-67-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4776-83-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4884-99-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4928-81-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5012-100-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5404-82-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5460-104-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads