gh0strat | 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
Size 106.0MB
Sample260824-varjsa1bpg
SHA256 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2
MD5 14ae4de065de6bfc376d12469ba4077a
SHA1 fced4987cb78c96b22a8d195a72e6bff358ac51c
SHA512 6c604b9db62630cf20b58492b01b9f5e658f9c91e09fcc76b8b7eb1548bab83e75fc881242e2b18db56c350cdef848420468f62d4cdc570a60cb50f1e4d78f84
SSDEEP 3145728:vO9QNvN0Qh5cgk7J85r/eLQC+Nqk4EWq07m:G9Q5N0icBdUr/Qx+N0Em7m
TLSH
T149383316BA9988FCC699C070C30B4B726A75B0CA1B316DFF46C4CA743E766F51B38619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat purplefox rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/1624-223-0x000000002C740000-0x000000002C8FE000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1624-223-0x000000002C740000-0x000000002C8FE000-memory.dmp	family_gh0strat

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/1624-223-0x000000002C740000-0x000000002C8FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245ba-62.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245d8-94.dat	UPX
behavioral1/memory/116-97-0x0000000073F50000-0x000000007400A000-memory.dmp	UPX
behavioral1/memory/116-152-0x0000000073F50000-0x000000007400A000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000245d8-94.dat	acprotect

Executes dropped EXE 19 IoCs

pid	Process
1532	erGnOCbSSOddbbP.exe
2360	erGnOCbSSOddbbP.exe
5048	DriverDetail.exe
116	ToDeskSep.exe
4176	LearnSeek.exe
4872	LearnSeek.exe
5100	LearnSeek.exe
4992	TutorSteer.exe
4564	UpdateSteer.exe
392	UpdateSteer.exe
3908	LearnSeek.exe
4428	LearnSeek.exe
2496	StartDirect.exe
3796	StartDirect.exe
5052	UpdateSteer.exe
1288	DriverDetail.exe
220	StartDirect.exe
4752	SessionSummarize.exe
1624	DriverDetail.exe

Loads dropped DLL 3 IoCs

pid	Process
116	ToDeskSep.exe
116	ToDeskSep.exe
116	ToDeskSep.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1120	tasklist.exe
2944	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UpdateSteer.exe.log	UpdateSteer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartDirect.exe.log	StartDirect.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LearnSeek.exe.log	LearnSeek.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000245d8-94.dat	upx
behavioral1/memory/116-97-0x0000000073F50000-0x000000007400A000-memory.dmp	upx
behavioral1/memory/116-152-0x0000000073F50000-0x000000007400A000-memory.dmp	upx

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ExploreDescribe\2_LearnSeek.xml	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_DriverDetail.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_SessionSummarize.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\wsc_proxy.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_LearnSeek.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_StartDirect.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\SuperviseDetail.sys	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\SimplifyAim\ToDeskSep.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\SuperviseDetail.sys	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_StartDirect.xml	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\1_LearnSeek.xml	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_UpdateSteer.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_DriverDetail.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\LearnSeek.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\powrprof.dll	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\wsc.dll	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\wsc_proxy.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\StartDirect.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\SuperviseDistributorMajestic	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\ExecuteContributorRapid	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\1_LearnSeek.xml	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_TutorSteer.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\LearnSeek.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\powrprof.dll	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\StartDirect.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\ExecuteContributorRapid	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_UpdateSteer.xml	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\2_TutorSteer.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\UpdateSteer.exe	erGnOCbSSOddbbP.exe
File opened for modification	C:\Program Files (x86)\ExploreDescribe\UpdateSteer.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\2_SessionSummarize.exe	erGnOCbSSOddbbP.exe
File created	C:\Program Files (x86)\ExploreDescribe\wsc.dll	erGnOCbSSOddbbP.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\UpdateSteer.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\UpdateSteer.wrapper.log	UpdateSteer.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\StartDirect.wrapper.log	StartDirect.exe
File opened for modification	C:\Windows\StartDirect.wrapper.log	StartDirect.exe
File created	C:\Windows\StartDirect.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\SuperviseDetail.sys	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\TutorSteer.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\wsc_proxy.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\UpdateSteer.wrapper.log	UpdateSteer.exe
File opened for modification	C:\Windows\StartDirect.wrapper.log	StartDirect.exe
File created	C:\Windows\SessionSummarize.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\StartDirect.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\wsc.dll	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File created	C:\Windows\1_LearnSeek.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\DriverDetail.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\LearnSeek.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\LearnSeek.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\powrprof.dll	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\LearnSeek.wrapper.log	LearnSeek.exe
File opened for modification	C:\Windows\UpdateSteer.wrapper.log	UpdateSteer.exe
File opened for modification	C:\Windows\1_LearnSeek.xml	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
File created	C:\Windows\UpdateSteer.exe	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TutorSteer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverDetail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SessionSummarize.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverDetail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erGnOCbSSOddbbP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erGnOCbSSOddbbP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverDetail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDeskSep.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe
5048	DriverDetail.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeRestorePrivilege	1532	erGnOCbSSOddbbP.exe
Token: 35	1532	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	1532	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	1532	erGnOCbSSOddbbP.exe
Token: SeRestorePrivilege	2360	erGnOCbSSOddbbP.exe
Token: 35	2360	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	2360	erGnOCbSSOddbbP.exe
Token: SeSecurityPrivilege	2360	erGnOCbSSOddbbP.exe
Token: SeDebugPrivilege	4176	LearnSeek.exe
Token: SeAssignPrimaryTokenPrivilege	4176	LearnSeek.exe
Token: SeIncreaseQuotaPrivilege	4176	LearnSeek.exe
Token: SeSecurityPrivilege	4176	LearnSeek.exe
Token: SeTakeOwnershipPrivilege	4176	LearnSeek.exe
Token: SeLoadDriverPrivilege	4176	LearnSeek.exe
Token: SeSystemtimePrivilege	4176	LearnSeek.exe
Token: SeBackupPrivilege	4176	LearnSeek.exe
Token: SeRestorePrivilege	4176	LearnSeek.exe
Token: SeShutdownPrivilege	4176	LearnSeek.exe
Token: SeSystemEnvironmentPrivilege	4176	LearnSeek.exe
Token: SeUndockPrivilege	4176	LearnSeek.exe
Token: SeManageVolumePrivilege	4176	LearnSeek.exe
Token: SeDebugPrivilege	4872	LearnSeek.exe
Token: SeAssignPrimaryTokenPrivilege	4872	LearnSeek.exe
Token: SeIncreaseQuotaPrivilege	4872	LearnSeek.exe
Token: SeSecurityPrivilege	4872	LearnSeek.exe
Token: SeTakeOwnershipPrivilege	4872	LearnSeek.exe
Token: SeLoadDriverPrivilege	4872	LearnSeek.exe
Token: SeSystemtimePrivilege	4872	LearnSeek.exe
Token: SeBackupPrivilege	4872	LearnSeek.exe
Token: SeRestorePrivilege	4872	LearnSeek.exe
Token: SeShutdownPrivilege	4872	LearnSeek.exe
Token: SeSystemEnvironmentPrivilege	4872	LearnSeek.exe
Token: SeUndockPrivilege	4872	LearnSeek.exe
Token: SeManageVolumePrivilege	4872	LearnSeek.exe
Token: SeDebugPrivilege	5100	LearnSeek.exe
Token: SeDebugPrivilege	392	UpdateSteer.exe
Token: SeDebugPrivilege	4564	UpdateSteer.exe
Token: SeDebugPrivilege	3908	LearnSeek.exe
Token: SeDebugPrivilege	4428	LearnSeek.exe
Token: SeDebugPrivilege	2496	StartDirect.exe
Token: SeAssignPrimaryTokenPrivilege	392	UpdateSteer.exe
Token: SeIncreaseQuotaPrivilege	392	UpdateSteer.exe
Token: SeSecurityPrivilege	392	UpdateSteer.exe
Token: SeTakeOwnershipPrivilege	392	UpdateSteer.exe
Token: SeLoadDriverPrivilege	392	UpdateSteer.exe
Token: SeSystemtimePrivilege	392	UpdateSteer.exe
Token: SeBackupPrivilege	392	UpdateSteer.exe
Token: SeRestorePrivilege	392	UpdateSteer.exe
Token: SeShutdownPrivilege	392	UpdateSteer.exe
Token: SeSystemEnvironmentPrivilege	392	UpdateSteer.exe
Token: SeUndockPrivilege	392	UpdateSteer.exe
Token: SeManageVolumePrivilege	392	UpdateSteer.exe
Token: SeAssignPrimaryTokenPrivilege	4564	UpdateSteer.exe
Token: SeIncreaseQuotaPrivilege	4564	UpdateSteer.exe
Token: SeSecurityPrivilege	4564	UpdateSteer.exe
Token: SeTakeOwnershipPrivilege	4564	UpdateSteer.exe
Token: SeLoadDriverPrivilege	4564	UpdateSteer.exe
Token: SeSystemtimePrivilege	4564	UpdateSteer.exe
Token: SeBackupPrivilege	4564	UpdateSteer.exe
Token: SeRestorePrivilege	4564	UpdateSteer.exe
Token: SeShutdownPrivilege	4564	UpdateSteer.exe
Token: SeSystemEnvironmentPrivilege	4564	UpdateSteer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1120	4408	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	85
PID 4408 wrote to memory of 2944	4408	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	88
PID 4408 wrote to memory of 1532	4408	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	90
PID 4408 wrote to memory of 2360	4408	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	92
PID 4408 wrote to memory of 5048	4408	2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe	95
PID 5048 wrote to memory of 116	5048	DriverDetail.exe	98
PID 5100 wrote to memory of 4992	5100	LearnSeek.exe	104
PID 5052 wrote to memory of 1288	5052	UpdateSteer.exe	123
PID 220 wrote to memory of 4752	220	StartDirect.exe	126
PID 1288 wrote to memory of 1624	1288	DriverDetail.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq ZhuDongFangYu.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq kxescore.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe
  "C:\Program Files (x86)\ExploreDescribe\\erGnOCbSSOddbbP.exe" x "C:\Program Files (x86)\ExploreDescribe\\SuperviseDistributorMajestic" -p[)+99PKgFXpJExploreOrganizerGentle "-oC:\Program Files (x86)\ExploreDescribe" -y
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe
  "C:\Program Files (x86)\ExploreDescribe\\erGnOCbSSOddbbP.exe" x "C:\Program Files (x86)\ExploreDescribe\\ExecuteContributorRapid" -x!1_DriverDetail.exe -x!KKaInQAGAiYgkAv -x!1_TutorSteer.exe -x!1_SessionSummarize.exe -x!ddzg -x!jvcgj -x!hjbjl -x!1_UpdateSteer.xml -x!1_UpdateSteer.xml -x!1_StartDirect.xml -p17]28hrRQLlhPromoteNegotiatorKnowledgeable "-oC:\Program Files (x86)\ExploreDescribe" -y
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\DriverDetail.exe
  "C:\Windows\DriverDetail.exe" -ExploreDescribed Explore -ExploreDescribeS Describ -ExploreDescribeP 1110
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\SimplifyAim\ToDeskSep.exe
    "C:\Program Files (x86)\SimplifyAim\ToDeskSep.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:116

C:\Windows\LearnSeek.exe
C:\Windows\LearnSeek.exe install
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\LearnSeek.exe
C:\Windows\LearnSeek.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\LearnSeek.exe
"C:\Windows\LearnSeek.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\TutorSteer.exe
  "C:\Windows\TutorSteer.exe" -EraseSpecifyd EraseS -EraseSpecifyS pecify -EraseSpecifyP 1023
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

C:\Windows\UpdateSteer.exe
C:\Windows\UpdateSteer.exe install
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\UpdateSteer.exe
C:\Windows\UpdateSteer.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\LearnSeek.exe
C:\Windows\LearnSeek.exe install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\LearnSeek.exe
C:\Windows\LearnSeek.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\StartDirect.exe
C:\Windows\StartDirect.exe install
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\StartDirect.exe
C:\Windows\StartDirect.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3796

C:\Windows\UpdateSteer.exe
"C:\Windows\UpdateSteer.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\DriverDetail.exe
  "C:\Windows\DriverDetail.exe" -ExploreDescribed Explore -ExploreDescribeS Describ -ExploreDescribeP 1123
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\DriverDetail.exe
    C:\Windows\DriverDetail.exe -ExploreDescribed Explore -ExploreDescribeS Describ -ExploreDescribeP 1194
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1624

C:\Windows\StartDirect.exe
"C:\Windows\StartDirect.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SessionSummarize.exe
  "C:\Windows\SessionSummarize.exe" -ComprehendGeneralized Comprehend -ComprehendGeneralizeS Generalize -ComprehendGeneralizeP 1111
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1_LearnSeek.xml

Path C:\Program Files (x86)\ExploreDescribe\1_LearnSeek.xml
Size 465B
SHA256 c94abecda046656c4c7c22119545c37ec0bc5d960af6ed7d376fa644022ab734
MD5 ca9239108e7474efd714eded7447ccec
SHA1 8acbaea6a525ac8b55fa45d8594c73390a9f01ba
SHA512 5be71fa6845737f970cfd43f71720188e728317d1c1eba924da7f896aeffb405ee8564ba0069b88782bd3a45be1c30aa94b6842797525d858d1eafebc4be86f9
TLSH
T17EF0272409C6A9A329399069FE21E3291812D28890C82AC2B9D58702618A9D969FBF06
MD5 SHA1 SHA512 TLSH

Submit Download

2_DriverDetail.exe

Path C:\Program Files (x86)\ExploreDescribe\2_DriverDetail.exe
Size 12.2MB
SHA256 15f23022f9b591d56d8d962c595ba93cdc37a1f35f98bf3ca09ee927819179a7
MD5 7771af1017fcf37c05fce252690b940f
SHA1 7da82cb06a101a673d8a02936427f5791cdd1390
SHA512 4c7457c8582ea69ed4bfd17c2296f475a65989cd9d9db43db88dbe0e2d1fc79c5021be4d5fb85670ee19b0ec4c573e63e4dd901660fe0dc7fd75fa98d8b4b145
SSDEEP 98304:aHqqqrzZe5K/ZD6IUot1ZhwWGbqSKn9uLR4SbjpWvdyb8VRLYI7sKdWeJ+JnbO9j:oqVFu6Cxzyta6Z8p79Y
TLSH
T125D62950F9CB55F5DE03283044AB526F67305D098F21EBDBDB247BAAF833A911E36648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_LearnSeek.xml

Path C:\Program Files (x86)\ExploreDescribe\2_LearnSeek.xml
Size 424B
SHA256 17ed8ab7df13943414cc6bdf25e9d1710c9739e5177da3a3b60c586cd1ca658d
MD5 dd22be4f56d4e171bb9b9f48a87cf4b3
SHA1 48a747c5836dfefff3c86794fad06f81104b6402
SHA512 6a1743ce4898c7b34a0dce1dfcb9c7b2328e2da5364bcd96193d06b90b6c8041814d15c72086407c02a4456cc31ee246fb72e369e359964356560ffc924e3711
TLSH
T1DCE0AB500AC679F30C799456F922D3263862D38419D83ED1BAD20B0725CA5C9A8FFF02
MD5 SHA1 SHA512 TLSH

Submit Download

2_SessionSummarize.exe

Path C:\Program Files (x86)\ExploreDescribe\2_SessionSummarize.exe
Size 9.9MB
SHA256 b7eb202fad4999c32f833161c344ad2426fd54fd7aee7a91811b3c8ba0ccf0e1
MD5 e0ac075f7e9774bc1bab287292f8a077
SHA1 80281c8724f1e056bf23f18596a0f4d558daa577
SHA512 a0937ed1ed3e043dc5e686eff36fd935b7e676f08e4160f8d8579e9d2bee07de55ac8e678baba59c580d2d5541f4c93a8cd75825151c5659ae924bbf8167a9c8
SSDEEP 49152:LLmTrfh8J5EM0dWZ3yS+47IjoDWqtRJK7A0En1+DojvftDDysXB2ClSj4YSRZ1BQ:fmTrqMM0dW5n+4ItcpJfXBvnTswC
TLSH
T19FA62950FA9B50F5DE031930449B627F27346D058B28DBC7DE20BEA9F87BAA1193325D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_StartDirect.xml

Path C:\Program Files (x86)\ExploreDescribe\2_StartDirect.xml
Size 469B
SHA256 11b2b40329450cf42b075c69389f740474bce752e1baa59562ef5f046dcf1ebb
MD5 f00cfbdaecbe9684843a04efeb6447bf
SHA1 1ff9d2cf9b064c1764a0dbc14b7905f0a6337082
SHA512 8ce4129f0495e53dd007d30485f12b5404eed454e3c16c3eac4bcfb4025949092c3273fe6cbc1a9397072afde1e42dc2091b498568d70579c4a7182e929b1016
TLSH
T1BBF097B114D271FA1C3DA862FF336BE981B2E381744918A172E50B438040CCA89DBF4B
MD5 SHA1 SHA512 TLSH

Submit Download

2_TutorSteer.exe

Path C:\Program Files (x86)\ExploreDescribe\2_TutorSteer.exe
Size 9.9MB
SHA256 beecad9cd86f32084f422bf06760ee2686f0095642c1d3458f141524240b21a4
MD5 45a6d923eaafb741f49eccaadbe9f8ef
SHA1 0b88a7388dc62ff35e8dc72c8a63381487b986bc
SHA512 42d10be24c2b5596562bad15f3daecbce92585865d39bf640dd9ab8b405ab6cc384f83ba8cae2149bdb559cb0999365ae057c6bc33b7df66e03be2910289ca7f
SSDEEP 98304:SuPPmotUSjhS0WGc4Sa0wjdzOcnuI8vesty+BWCR:hPxtcNaldzf58vFty+wE
TLSH
T135A61A40FA9B40F1DA031A71549B627F67346D068B38CBC7DF50BE9AE87B6921D2311E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_UpdateSteer.xml

Path C:\Program Files (x86)\ExploreDescribe\2_UpdateSteer.xml
Size 441B
SHA256 2fc86edf1592d1d4bd9e7dcaafe97ba2f8ba3e95f8915e8e93349898403d194f
MD5 9d938b6e441efce791a4669af9f66d36
SHA1 e0d38e675ef9211a75092917f221a5d478bad036
SHA512 de22c5096209a6e33e6cf29b9e11f9a9e193e90d6f628157c35a80d05ff2214549343d3c496316d32df4e8223408499b40b04dfa69f0fa27b6f39cb22604a696
TLSH
T1B5F05C8208C67BE6A83F40467C3296152962E3E4D0440890B2E245035980ADD6C3FF03
MD5 SHA1 SHA512 TLSH

Submit Download

ExecuteContributorRapid

Path C:\Program Files (x86)\ExploreDescribe\ExecuteContributorRapid
Size 6.8MB
SHA256 b7a6fab3421800952647cfe8e41c0d4542a363c31a39e0a6c931f93d57a02f34
MD5 4f238ec42aeae2e07f1e08b6aeaeccfb
SHA1 22bdc841db2dac507a99f2fb1fd1ec8d88df66af
SHA512 102bad9d35f51c7273aa52f70d6e49087a3b7d2c3b46c83303726b2b18bd242caccac0b818ea4bcce449ee6cf1b7ffbb7b39ece7cbb83f5b1ac367010103128a
SSDEEP 196608:xus7uGIYQZIdlqaj1Zqd3ZUZ2O1r9vf0xGeCMD:xuKdBYUZ2O1eD
TLSH
T173663373B478DAE766340A56A81803F52DBAC4DF0D091BA6E15888FB46CF84FBD75138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuperviseDetail.sys

Path C:\Program Files (x86)\ExploreDescribe\SuperviseDetail.sys
Size 470KB
SHA256 9ec2208d18ddd14080991962c4eb303e099c0aa03ec29c0b2bff64278971a040
MD5 3515c05c62754981ddd41f01b04e28b4
SHA1 05e33b78c7099a6a566733cd0092a2b1a3387d0e
SHA512 ac56601f72ce898671f26c76e0e626316840e6ade987ead118c7a59e1431caf87573db057adbfb7f31e6945906755fdba35d6f8592d405b235a8043d5d3c55ae
SSDEEP 12288:i0UDgQt0+0lPGqVKUZQyMgOEpxkeAsmJqk6Ro0xvNKj0:i0UDLtn05fsUWyMdEpK4mggQ
TLSH
T10DA433BE1E497C01245CE9C74B370E9063ACCAD97F19A6A26B524478E1C6E1F123F4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuperviseDistributorMajestic

Path C:\Program Files (x86)\ExploreDescribe\SuperviseDistributorMajestic
Size 6.8MB
SHA256 df57a83b5a029ec3aab81e185c5163d3969408fcfea93828006340f2a395e09d
MD5 cf6c9d03a0f696bf96a3661df442f59b
SHA1 06bdf242cdbdb6e6a6ed36d30ab06aca74146ad9
SHA512 f87c313eede49a1d20383c0c64c08f64928812a1075e6802d8483365c5faa9654ef82fb1b93d4c5e47e9a31def242ed8d20fe4c14f44a4b5251c35285c35de6b
SSDEEP 196608:KEVo7HmlavpQUtfZjbGMDfxxFITfvnYqU9xhW9Gf:uDKaRQUtJv9xFI7nYn9Bf
TLSH
T13766337CAC90D3EB838896D9065BD815C91D5AFBC42644E7E74F98E6B913380CEF422C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSteer.exe

Path C:\Program Files (x86)\ExploreDescribe\UpdateSteer.exe
Size 606KB
SHA256 7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664
MD5 4e85cc36adc996c3ddd3a9825d4b7f73
SHA1 e5aa0e5db7d9fd27e2a0484f3fd6c322fc5ee97f
SHA512 2d7b7c5eb54cf68a218fca7239c0e194af0b81796e621bc039edccea64b60a202670a47af207988467a8c25584cef96a6652f52d53464ce3cf01006c680f2980
SSDEEP 6144:HcNM+RCns3iTVqKxGE5eYHM2GevEYlm3NI0vHhaL3gEXm//mAm+snmFMuImPSyqj:8NvRWVqceY1Emm9t2QEQmNONI
TLSH
T1F4D427103BF8961BF2BE37B1A97006249BB4F956E7BAE74F598415AC1C637008D2137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erGnOCbSSOddbbP.exe

Path C:\Program Files (x86)\ExploreDescribe\erGnOCbSSOddbbP.exe
Size 577KB
SHA256 06654d17334fa342f62d42bd805c8bc6da8105612d9ff45c45b8f092a7c46e17
MD5 0fe04f5747f21419bc96e130b2068238
SHA1 558279fe10e5dc98419c3d7e138a569e7ca59011
SHA512 a76fe81d96b1c4af92f4cee5ec567cee1393960bccf290963541e50df0b5286154878de577f7e383b5c0a75a4e134b71243e4e6154ab10ddda0d7a3a4c1a939b
SSDEEP 12288:YdyZcuzXeA53PgZ/C8Qdi7cP/ruuX56cEnjsFMfVS63TLR2Ry:YdCLeSE/CDdigHrvkJnjsFMN73TLRWy
TLSH
T18CC49F163AE5C07EC6521530CB1E6BB590FE83680B3248C767C45E6D2B349E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powrprof.dll

Path C:\Program Files (x86)\ExploreDescribe\powrprof.dll
Size 386KB
SHA256 48fd5d505685f86b64bb57d06255145c3892f5a0b575bf69f1553bb7755e36d1
MD5 fb761ccef534d74c038eb2bb06d92520
SHA1 5ca25ad5f758867b74e588d1762f4f4a0dd85c38
SHA512 a02455ecb16ca0baf95a72e199686906bbb5cf085edba93528c4c1606277f5fbc5ee7598f81f4d520d95ae7bd831fb18b85546033a15cdfa1736c501a62ee3e8
SSDEEP 6144:vzsGQm3VKUPObloEs5kDph0lhSMXlBXBWHt07CiTzl:gGl3VKUPOrph0lhSMXlCa5TJ
TLSH
T1C784AF10F5C6D072E15E0A70A9789FA94B3E9D508BDA29CB77985CB74E301C1AB35B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsc.dll

Path C:\Program Files (x86)\ExploreDescribe\wsc.dll
Size 3.7MB
SHA256 1c3f2530b2764754045039066d2c277dff4efabd4f15f2944e30b10e82f443c0
MD5 00f206b3dfc921f0c696b0c346e39fc9
SHA1 fbfdc8bbff6225cebcc4f005c985159096b0d709
SHA512 98fc6510a9c7bf1b511e5c00c4e8b16f2e28f4204f2c557988d2e16107abbc3138e7624e33620bd7c854cc0487a82f9a6fd23932b83e68c7d8d20fe1ce50e1f0
SSDEEP 98304:FvDRuz3nnji9jnZOUhrjOuf9q9hmbwdy:FvDRu7nj4jnZOmrjOufo99
TLSH
T172067E1076078426E4DF12F19A78576BD63CEEE50B7140C783E5AAED0D528C36B32BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsc_proxy.exe

Path C:\Program Files (x86)\ExploreDescribe\wsc_proxy.exe
Size 55KB
SHA256 bd4635d582413f84ac83adbb4b449b18bac4fc87ca000d0c7be84ad0f9caf68e
MD5 06807d8d7282959ce062f92a708d382f
SHA1 ff2d55a844c1fd37b3841cefa7e2d21de5fa8bac
SHA512 fa3a37034c631410b04a520337c0c45b53e667daf9d793512a4f6e096778503f2a6708bcf2e06a3eafe269845fe72e64cc95bf580ca8f65171d1d22ff931b478
SSDEEP 384:1wwgWTQGUdyG46/PygAYdoB30uRVHDOhFHMszTkak4FJZEuV9TUUhX7veFh9ZsZm:1yGI/PzmESYUawSgUhaFhe5DGwhMf
TLSH
T19643A4125E101911D86A0A30E05DBA1E1A337FF75A30926B3A39FCDDFE6C77B2464B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseD17.tmp\System.dll
Size 12KB
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nseD17.tmp\nsNiuniuSkin.dll
Size 287KB
SHA256 33e460a080a621cda7896e96b6f1beee802b485cf99e18b27463cd362c484b08
MD5 bb0cdff5ac2d64723007a0b4f7962a02
SHA1 410889522ee8ea7308b054f71bc4cab078295e06
SHA512 b4dc2614f01f5f01d5dec9e6a41e072d01e924d8a94ac0dc1050399fd1dc3cc8d53d7ccf162d750d166fca200771b0850191b30c7caada8edea9ba6d686e2402
SSDEEP 6144:EfuMPhou62ZrZxAxgGTpMayh91VDrH10nCRwbDB0Q5MeKxhwNsN:M3hC2lZxAxSpRbWnmADBpM+iN
TLSH
T15A5422462F7D6833F8FC0E3A76844625B513E253A431C4C912BDDB80E97572B6B8A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nseD17.tmp\skin.zip
Size 733KB
SHA256 6c979c5efd4bca0ea050f24c2a063ce88d3fc02dfa4bc11f3bdb169da6e0875b
MD5 121c40b2f8f3407211a14efec60088d3
SHA1 36bb7a0d4132f10cb165eb2b388489d7b9b3057c
SHA512 23efc5b5c0ccc25ec568557f9e7a9a8237fbc86a9ccec7214b7e68482171c6a8077a8a1ffc123ce0078ec2771b00b0494a713289a2215919625e1911a5608266
SSDEEP 12288:Hw+KAT8alkacATdefeWU/hK4lTp+77YTStyx038GusKjWU/yK4lTDPaGWzMIMrwc:Hw+KATNTcATofe5/hh0zs+8sKj5/yhlt
TLSH
T1E4F423B7F052FEEBD8E6A7BC381E010AFB92575E8635E3339846C4C94B5A784CD20615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 209B
SHA256 1092bfca028e687715fc73f44265feb62ae86deda436d5f6ec57289e6ded8392
MD5 12d14b7daa2dac34e10aeb3a492120aa
SHA1 2bd92768cdefb0e134b5a49acc1ff296d93abdc9
SHA512 5f3d705e5a038c36220c9f54de903d0d03797a3f227fb1dfa423e445b6b2b92aa764ff93393cd7519d0ba480f535abc9cf9f910091a689ec9ed0e1d4665bf49c
TLSH
T194D0235305FC00783F7A518BC21527467740F634C34130303A50D9C445C01325CF43DC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 357B
SHA256 dd68392fc5b80867d958f6f804c5c6f8bbd39fc00a740114929b4bb48b1b06ee
MD5 156d40784d55f411b9991828b1c51fb5
SHA1 00e45b9646f90d4f727e4740740dce8b216266eb
SHA512 dc471debd3425cac2e45496a2f7de739aff1e94dd267a6c57f84a7752c028fe57a243b8189d81b9327aa1ea77aeb7f40d283663c58088fd77386708ae3d15bb1
TLSH
T1AAE0D86202FC11793F7A155B91191B867B01FA20C34220313A60D98844801766CF43ED
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 484B
SHA256 cb0e9e5aef2241bb0ca62200e3f52cdddfa2af52d9616afdfd842b093a828a72
MD5 3327324b902892006236e0b370b00a3f
SHA1 6fcd7a41b9c9abe1f983fd6da573fe80805042ba
SHA512 99d80b655b11ee82ce319775b5ec2fecc075608a2a6c51dda58bb1ff002a15dbe6591c47c8cd9d72c52d7897e3a8cd6ac85c16fb878f4e95220f790a79090e5a
TLSH
T1E0F0E26202FC10BD3F7A119B821A1B9BBB41F630D34220303E20E94844C0167A8F43EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 616B
SHA256 b20f6c1b2fb50510d96ac9ea08ef9415d1258b958bbd542864841c2e0aa8ffad
MD5 01e64722c629766d937e91cb15bd9ce1
SHA1 85bca1adbf9f2d70c6110cb949e25d5c0cf6cf4e
SHA512 597ee65819e80c9229c0da8c285a5dc63e4e0e0ca7d458ada462969b70d6195d86d82861abd88dd69f0d48a7fc1815a9ceac406153f49c4e6d8b425594ae618c
TLSH
T1E6F0286203FC10BA3F7A155B821A6B9BBB01F520E38130313E20E54845C912B6DF97EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 801B
SHA256 47080dd3ba63df0b3b739bc403c83d0cb7c81de1c4678a41840da24e961744ce
MD5 32bfc2c5c0a8ec4677d922bea28b6db8
SHA1 7f553aafeba6cd56e2325bae5f5d0f0eaed7cf6a
SHA512 cf79768577f5f2debe2abc530a1ebb5a1e777a1652e84d17d6630bd8f6da10c973f0e360d81f38914d14bd225a336b675f1cd9ef88beccaf37c8708c844c19f9
TLSH
T12A018E2203FC10BA3B66149BD2165B57BF06F520E38630313E70D1485AC81366DF97EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 865B
SHA256 f680a7be99b7cf2350e729102fe11cd393518595ce18d6d9a85d75d2a4aa5c62
MD5 afce153669a0ba16a569daca885fc146
SHA1 799c1551dace7396c30ff45046372ca846874c52
SHA512 26fe8f85495791c5470f277e680a5b893826b234b9c7e22e945e155f27bad8f341e20b073fa5bba6ba9c6df6f3908d9561aab0519bb762ffb089b1e68e21fd40
TLSH
T1A311596203FC10BA7B6A189B92165B57BF02F620E38630313E60E14859881376CF93EC
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.wrapper.log

Path C:\Windows\LearnSeek.wrapper.log
Size 1KB
SHA256 051b35652e11941c9e530bb080ad4871ad97399441b72a2dd81dccedb250cb86
MD5 7797ca00f6aa9450ba7542633328b2a1
SHA1 cbf47550ddd37425f9bf6f95537a60290e76d20b
SHA512 afb50a5bca03ed5b5380c2995308d5a2f0347f6a6d04937277e18d0229919a7040808e252d70327177668f35b4d48eb81f6e574baacd5851b9581078fe82e223
TLSH
T1DC11686203FC11BA3F6A146B921A5B97BF02F520E38630313A70E54849C42776CF83EC
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 64B
SHA256 2c2b917ad3f716243039668a5fd8d629558b8503c494c32e1a0e164a85cabe24
MD5 e869f90242785ac94396b146ca8e1bf8
SHA1 472d2978fd1f8f0f54bfc3482e1e14af8345c98f
SHA512 df819c3887e111a79987e355e238bd4224e2f7711806b468e5fa2bd28d2c259beef1ffb94dc78a7515385b707ee152a92d5729ec3f305a5e587f627b530ceaf0
TLSH
T18EA022A223FC203CBB380803022C8380BB00FA20A2C000300200B008802022220A03EC
MD5 SHA1 SHA512 TLSH

Submit Download

StartDirect.wrapper.log

Path C:\Windows\StartDirect.wrapper.log
Size 128B
SHA256 1d2c41bb088bd08966771981b0ffb6af487cc9741f6adbee9ea80b12246f3768
MD5 7d8b8192a0ed53427d39586f9a9102bc
SHA1 0436c0cd9ce780de820d891e16b91b683cc90ac0
SHA512 56abd04f00f06d0e64bfbbce2fb078d38df01e29b2bee5a76395728ff7c935b39560e7433064fd391730d70e75697236d56112c67389a89c107696a8f3ad3505
TLSH
T1ACB092A323FC25BDBBBA1857526D97D5BB02FA21A7D110792701F008C46166A34A03ED
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 64B
SHA256 6821fd456f5f0ba9d60e6555bb892bfe05bb97a8d9671b985777781b32d99180
MD5 4d57cdda66023516c9a9702d67ccb785
SHA1 8ecdc1cea5eb95e0e819b182cb3481aaa34a0e6f
SHA512 b96231f3eaa902f2eb5cd32b3b87c1665db9c6807ca2e577fd0ea3c22fb97d3b46842468d9a1479cacf2f90dbb7a3f203032a7519d09b84bfadefec311f5c469
TLSH
T1A1A002A312F8297D7B691857531E9791BB01B621869510395601E10C88D156664B03ED
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 128B
SHA256 782e5770dadf123fd41b949c1c408fccc0a29eb3286d5cdd5e5cb00677d1e1c7
MD5 ecb7351f8010f6ea47bc3cbf8625ec08
SHA1 979b886d92e9166e3f9026866c4ff60f4bd9a870
SHA512 a341d5c6d4c90b4b21eb3abedd3e5551ad8b5e5a33484d5933a1f6c31f4eefe91e694f9fd7c25344d97c8efe2d98ae1c433ed0183fb6277f43c26213a786a465
TLSH
T150B092A312F8397DBBAA1857532F97D2BB02BA21869510392601E00C88D156664F03FD
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 282B
SHA256 8df289573ad5e11bfd32c422d36a9448f8dcfb0b3efa6b7531bdfea3f94ac5fe
MD5 ed5d019bca7df5c71e95d1223a39f2e1
SHA1 eaad5e173be8975d21092ca5700d02ac98b9f5e0
SHA512 7539613462cc552cf75f5898655fca7fb2be1d02bff2d0744c6f25c4801fd3a86829b177b9e4647c2da3cc039f534abfb5a0e9d5acbdd4eecdca78368af1aa8d
TLSH
T1D1D0C25303F82179BF8A0406411F0B853711F820D291202637B0E808448063ABCB83AE
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateSteer.wrapper.log

Path C:\Windows\UpdateSteer.wrapper.log
Size 700B
SHA256 6f8d0fe8a6640d5ce3b75516f2ac770b0cc997e61d875d5654f58a84c433b0cc
MD5 dc94fb9f287f71295ba7cfd122efe01e
SHA1 371010a310a03554d6d3223a15a4499f56ae4c86
SHA512 f947faa9103af1fde9db6648ca0337c983fba0cdd9ba52ced034d1fec37d6d9ae2f0c811a9b76c26f81ec716d187d81b71a997568c4240b3e409bd2d8613b4fd
TLSH
T14601478212F421B27A7B106F4E1B4A467350B034A56A312533F0E50A9BE5D2EA9763ED
MD5 SHA1 SHA512 TLSH

Submit Download

LearnSeek.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LearnSeek.exe.log
Size 1KB
SHA256 7253a1555ca5787509e338a9b09e6bd99f9db0ac6102baf21ca632ca8f8380d4
MD5 2da44f7c2b3721a44a3760ab180ca05e
SHA1 ce3325e28e5911967b403fee03f6cbf6b1b303af
SHA512 78d1cf7ea933c0d61426604c5010dde5d3111dcb1a0de2f1bb218b2bc654685de6830245e1a20efcb20b6cd16f0df862b75aa98b2ac467b3e6a66dfffe6ae1ee
TLSH
T1A72190712375E2E889163F471C68258407FF0724B990EE1CB6E8625EE93745B5F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/116-152-0x0000000073F50000-0x000000007400A000-memory.dmp

Download

memory/116-97-0x0000000073F50000-0x000000007400A000-memory.dmp

Download

memory/1624-223-0x000000002C740000-0x000000002C8FE000-memory.dmp

Download

memory/1624-222-0x000000002AB10000-0x000000002AB8D000-memory.dmp

Download

memory/4176-88-0x00000000005E0000-0x000000000067E000-memory.dmp

Download

memory/4752-215-0x000000002AC40000-0x000000002AC83000-memory.dmp

Download

memory/4752-216-0x000000002B040000-0x000000002B0AD000-memory.dmp

Download

memory/4992-146-0x000000002AB90000-0x000000002ABDC000-memory.dmp

Download

memory/4992-147-0x000000002AFB0000-0x000000002B02E000-memory.dmp

Download

memory/4992-153-0x000000002AFB0000-0x000000002B02E000-memory.dmp

Download

memory/5048-70-0x0000000000EC0000-0x0000000000F0F000-memory.dmp

Download