ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
Size 449KB
Sample260825-klcjwsgj21
SHA256 ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78
MD5 83d328cf538cb185c0ca760b39c1a5a0
SHA1 33826adfe416652048e253fc65e4cfe2ca4416c8
SHA512 1c4ae6b378008b1b87c4e13aacec689ce0dc17301b2e6f5d3768ef589ae9a6fe6a3b4d98f94f913a19ef2466eea3198025837e9072dd5f3f81a095b6b8020917
SSDEEP 6144:lXmRmnhE5QK6iBQL+W5rd1WjRuXZ9tZBE8eE+RiBkECdxT1XUTW5qXmLEvP9:Ej+lWjREtA8eE+AkbCT0qP9
TLSH
T1D2A4392A774CB772D2D301365F8CB694EEEEACB14F2156D36B88570DDE740C1AA3064A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
4808	Logo1_.exe
6100	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4136	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXABF1.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXB78E.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXB7AF.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCXBB54.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXAA62.tmp	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RCXB83F.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\RCXA7A7.tmp	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXBB94.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXA845.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
File created	C:\Windows\Logo1_.exe	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe
4808	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3952	4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe	87
PID 3952 wrote to memory of 4132	3952	net.exe	89
PID 4056 wrote to memory of 1728	4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe	90
PID 4056 wrote to memory of 4808	4056	ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe	91
PID 4808 wrote to memory of 3716	4808	Logo1_.exe	93
PID 3716 wrote to memory of 5236	3716	net.exe	95
PID 1728 wrote to memory of 6100	1728	cmd.exe	96
PID 4808 wrote to memory of 4176	4808	Logo1_.exe	99
PID 4176 wrote to memory of 2440	4176	net.exe	101

C:\Users\Admin\AppData\Local\Temp\ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
"C:\Users\Admin\AppData\Local\Temp\ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A1B.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe
    "C:\Users\Admin\AppData\Local\Temp\ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe"
    3⤵
    - Executes dropped EXE
    PID:6100
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXB4F9.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXB4F9.tmp
Size 139KB
SHA256 34ae1ca60d627ee0b2ffc94007747f430f00b4d65a0c8621691653fd209688a7
MD5 ffc79a046ec6a293fa07eef6580a0c26
SHA1 f1a73d2866a744d1274e0f7d3efe5118573d065c
SHA512 00a81e669e1719110ef348eda375e86e30ea49fed7db12a573c727728aa659382edab87e7c39fe03cecb0a0e3b37990060d9aff11c81856a96b4098c4029f545
SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxy:+CSjGoLpWM6bblmjxy
TLSH
T156D35F6DB14FB3F2C3E198BC8D1CF2D5ED28FE20DE19285A75993B0E9A7A0C35508195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB73D.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXB73D.tmp
Size 77KB
SHA256 c936005ef50b3bff07d9d168ecdc30ac4b57c2d2d5a39391c488bcf46cf0f703
MD5 dee97f074650e8209159aacca596d001
SHA1 8611ce0589fb8490869d9d6d6e2e5b5a5ad7f344
SHA512 e8c5299de945d09f1238b85febecca3f646e02a2f2c99b181508365e1120090f1c5341cb184e412461f3ae2b3ce6c6d276028a5959e91c805bfc0920fe9c6575
SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxM:TCSjGoLpWM6bblmjxM
TLSH
T1A573D756B18CB3B2D0E299BC8E0FF2E5BC257E201E1D589FB59A2F0DEE7A1C1550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBBA4.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXBBA4.tmp
Size 86KB
SHA256 853ee415285520ccc78789fa472e0519968eac7493a1a59e6b2747f925a715d6
MD5 8e7b28eefa80e6f6b0744cfea2e12c12
SHA1 1f41b1d6768b0f0cf1bf4b0db8e363bf9a20de57
SHA512 0d26f4b6f1d62979f9abe24e227824ce9be9b0558d0b969bc6f82cc6917d113bece2c3c5182aa8a7a777e899e74b254f928d2262e54e1b5c5ac4b5cb22ceea03
SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHi2:zCSjGoLpWM6bblmjxSdtPlLqr
TLSH
T1B8833969B28DF372D0F299BC8E0DF2E5BC287D301F19186BB69E1F0D9A765C2150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXBBF6.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXBBF6.tmp
Size 74KB
SHA256 ddc48a66623342b053a85c494d3b4a3ec0af06a3fd9273268babf51859aabdfb
MD5 d1019a2def9187ae76ad6e2e6bdc4cd0
SHA1 2e1a09273b5f18969978d2d9fe4517e7dc3a95e8
SHA512 19cf547b7001c3f322ffa35e6586c74073fa6ef858be7da76d2eea533e8cae569db6fa2e6b0f35696ef3edbc95424af6d77cc8d60facf90852a5f80f0926b5dc
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS:3CSjGoLpWM6bblmjxS
TLSH
T1F3732A69B28DB372D0F299B89E0DF2E5BC287E301E19186FB69E1F0DDA771C2150C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe.Exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
Size 4.0MB
SHA256 491db69434371c02ab24b56dc76227953c7194d49834a29789b8a7e9c04db3c4
MD5 e6e13ba86e3ec46608be7ff253b69aff
SHA1 4c4e5c82a80729c136bfcd042c43c6ca78dbbb46
SHA512 95fa368842028b9943b6f76b65a9be86e92c5c4bb0648ab7863b72bc79aa22d765e8321a44aa25040e6748486a6600465370f7153830fcc465de50d0f5989a2e
SSDEEP 49152:UudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:8ijnUdYd+RaAj
TLSH
T176164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 638KB
SHA256 d2bb6e7cc855f2622ffb2732cc3316fce329d0f3e9f24a3af42c0287bd0dccd8
MD5 fb89ea269d04285ac1e4f4cc4f421b97
SHA1 6ac49ded013b6e8c3f6fba834dabf86b78e1cc9d
SHA512 3409b91cdd1945c39923f47f5b96b2d044419d923fb9482afc286290ba226d0625b205915668762150d1bf102292a44a03c671fba439426ca7f94b9afb40fa03
SSDEEP 12288:Ej/XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:+x0Le5ji0hmxNrM
TLSH
T129D4F716F66CB331D0F2C0B9C5DEB69AED313C411B3089CB5286876C6E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXA7A7.tmp

Path C:\Program Files\7-Zip\RCXA7A7.tmp
Size 74KB
SHA256 941a1037a927bfb04dc89993f33be503088bb9eb5608e783f6084232059d5eb1
MD5 4959cb8e7d3fb449ce64648fedd31151
SHA1 31d45968d752f8543b809370ac10b7435e66d074
SHA512 2549b26f2200b8bc8194992de87920b258f6fd86fdaace07e992d041b69edeb5ad19738589f9f929255833fe4a269724bb489b7f8b7607adacfe6b167df75fd7
SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxf:DCSjGoLpWM6bblmjxf
TLSH
T1FC731A69B68DB3B2D0F199B88E0DF1E5BC287E301E19185FB6AE2F0DDA771C1150C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe.Exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe
Size 360KB
SHA256 b7dba98b727454f0f3f04fd78259a7704ca621b3d757a967a5fe2dad618599a2
MD5 04002262736a0d57b5121d6f1cf30a2d
SHA1 f676b767d4cacb80cc5e5fbc2c66825686b82536
SHA512 c1ac136fb5116540e4706a253396587d9e4e26f9cdc224328c5dc6b87f9fe99e40ab3f36c0bda4db5c7e9903a3870b0478c73236a3073f44cd90e87176700d65
SSDEEP 6144:1XmRmVAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:0KCd9/WYoaLHF3z0z04PDvhI
TLSH
T14E747C95B29C3BF4D8E381398D1DB556EDB27C250B20C61F23A8371A5F332911C2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPREADSHEETCOMPARE.EXE.Exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe
Size 537KB
SHA256 e8f61d863ad0156dfc872a5400885f495bae3cbd553822fdcfcc7e0dcf484a5b
MD5 62a7744be0bfc8e2e96baf03f00c1027
SHA1 42d202026a0a1d859047e99e5d2d2fd9e6d147da
SHA512 562d710524c880815dfe73a0004d86d4b1ad864132d7ddd1622e2ad0c814705b7424810dba0aa8ae8df8952ae1f3a6b0450455c6a05efc488f54341dc548a49a
SSDEEP 6144:ZXmRm/zyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+br0YzirzhafYmf7Pvm7Mqfj:ggDnVDcmd/6JAB/6N30xQ+hpvm7Mgj
TLSH
T1F3C4182132EDB318C8FB1B70DC3DB6812E767EA66D81C6AE29543B5D4D723428311B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXACB6.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCXACB6.tmp
Size 83KB
SHA256 eee6b34bc8a6650341fd8dbaebf69f027518ab35daa35d3ca6bfb1b285554bdf
MD5 d08d2d7f0c6e4c4cf78ae1717c34990d
SHA1 63ec5ba4f7887ca032827c0dc894a2cef40729fe
SHA512 a3cc5860f37dea5f65283985b40558609f77c34ed21cd5dc756c9b274b67a67350dbc28bd54b6368c00c18670a100db49eedb623d56690ebf32f7952522edd06
SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3q:/CSjGoLpWM6bblmjx7Uq
TLSH
T1D8832855B68DB3B2D0F189B89E0DF3E5BD247E301E59185BB2AE3F0E9A771C2150C189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC195.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXC195.tmp
Size 75KB
SHA256 d6364875b9ba7ce30bde059f802df93956f8a35d8af731b777ed2af2d5bb0dd5
MD5 847218fe978cdf18cc34cafbe1e8df74
SHA1 c54d25169c8c82ce5fed17fc92a431d148f47c1f
SHA512 b5a41a4d0cf858293b0a174b726672df96d7627a623bfba61dab2ffadd366bc270dbf76e65902040bb553f286bc4fe116fd72e77d7704c4ac639f5e06f19f513
SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxH/:HCSjGoLpWM6bblmjxH/
TLSH
T1F8732A65F28CB7B6C0F299B88E0DF2E5BC247E305E29186B769E2F0DDA771C2550C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1A1B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1A1B.bat
Size 722B
SHA256 4f7b4e4cd1a1dada0531ce6aca468ba9473aa79a866a3a1f11fcfacbb5879daf
MD5 3f406bb70f51c14f3b2d7edb617d7803
SHA1 5c50f4103f544247e8ecfe9368e69fd8ab4c1d64
SHA512 3d73970ae677ed99be3c481bfc8aa5820c987d2355f1b3db44e326c61c4ee732f23437e17db39cbefc3ef9de35c700a5929a1e881d11e2a266f2eeb2785d475e
TLSH
T12301DB40C28FBBB6DD431442317C568EE11B2F6E79463B014B31559D1546D4FB9AE14D
MD5 SHA1 SHA512 TLSH

Submit Download

ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ec9f005e1fd90db6c1f9182e45ecf8af1b73d6c7c564ccc8d83ab915167b5f78.exe.exe
Size 360KB
SHA256 b57dfbd41b892bf80df298222cdb3800cc19937af34e04d3868b74522e4dce06
MD5 cc3707cc88764501a1539927e19df80e
SHA1 4bfa44cb06b0dcbded0917d49fb9cbbf1750da08
SHA512 70f764f4b7bb2437de74d8797b9783c3746382261af264639979d76b776c53478c3a7957d4ab01a3f29a8badc4b48f0965264cff99d5ed8fb7a4ffee5a3754c2
SSDEEP 6144:uK6iBQL+W5rd1WjRuXZ9tZBE8eE+RiBkECdxT1XUTW5qXmLEvP9:ulWjREtA8eE+AkbCT0qP9
TLSH
T179743A2A7B489872E21302365F8CB794E3FE90B54F3157D36B88571DDF744C2AA31A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 89KB
SHA256 0192bb031873e443ff9054d2ffc252843d57d1f4ebeb19bc8cc9e05aaab024f4
MD5 6447493e8870d791a7b907f814a07d58
SHA1 e6e991bba242f8da107acc432aa1e2b29f757c82
SHA512 c78d11b41b939b1616a059e9206cf8d84ac7a11b443088f08dd2078b24cd47696627167e5f7960d2487517d5fcec31a95d4e8686a843c289af79652f1a8a79c4
SSDEEP 1536:+7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxBNTcQ3EAi:vCSjGoLpWM6bblmjxBx3EAi
TLSH
T18793495AB2DCB376D0F25AB88E1CF1E0BD3A7D201F29485FB59D1B0D9AB61C1190C386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4056-8-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4136-16-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4808-18-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4808-709-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4808-1251-0x0000000000400000-0x0000000000427000-memory.dmp

Download