f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
Size 8.4MB
Sample260825-vb469saa48
SHA256 f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886
MD5 28da499d186e73d6c2f1c908bcdd08e5
SHA1 d1001c720a4be7e783739c41025ea0a023eff597
SHA512 52fb7a3199d76ffdd09b5df2394ee98fa3b703cec61811c7ad8037582a7cf9d46c1665425bf43af05b2b1cea2d994387e4bdcb09ec51ed54b8be2ea70ae20af3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBc:TDpbgBr/4QAMQMrEGRONY/4VLjlB35c
TLSH
T12F9633EA785F6ABBC10E1C798D068D6275BC5BB2CB644CD7FFC53EB60850C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	InputService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	CoreSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	RuntimeBroker32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	UpdateService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	ServiceHost.exe

Deletes itself 1 IoCs

pid	Process
3928	NetworkHelper.exe

Executes dropped EXE 15 IoCs

pid	Process
4980	NetworkHelper.exe
3928	NetworkHelper.exe
3572	CoreSystem.exe
4304	CoreSystem.exe
4612	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
2332	NetworkHelper.exe
3836	NetworkHelper.exe
3000	UpdateService.exe
4200	UpdateService.exe
4072	ServiceHost.exe
3848	ServiceHost.exe
2524	InputService.exe
4276	InputService.exe
1300	CoreSystem.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\RuntimeBroker32.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\NetworkHelper.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\NetworkHelper.exe\""	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\UpdateService.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\InputService.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	NetworkHelper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
100	raw.githubusercontent.com
117	raw.githubusercontent.com
127	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
64	raw.githubusercontent.com
78	raw.githubusercontent.com
97	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000243fa-21.dat	suspicious_telegram_bot
behavioral1/files/0x00070000000243fe-89.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024410-125.dat	suspicious_telegram_bot
behavioral1/files/0x0007000000024412-160.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000725-199.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000729-235.dat	suspicious_telegram_bot
behavioral1/files/0x000300000000073b-279.dat	suspicious_telegram_bot
behavioral1/files/0x0005000000000729-318.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UpdateService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	InputService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CoreSystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
4980	NetworkHelper.exe
4980	NetworkHelper.exe
4980	NetworkHelper.exe
4980	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3928	NetworkHelper.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
3572	CoreSystem.exe
1992	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
1992	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
4612	RuntimeBroker32.exe
2332	NetworkHelper.exe
2332	NetworkHelper.exe
2332	NetworkHelper.exe
2332	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3836	NetworkHelper.exe
3000	UpdateService.exe
3000	UpdateService.exe
3000	UpdateService.exe
3000	UpdateService.exe
4200	UpdateService.exe
4200	UpdateService.exe
4200	UpdateService.exe
4200	UpdateService.exe
4200	UpdateService.exe
4200	UpdateService.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4980	4136	f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe	87
PID 3928 wrote to memory of 4304	3928	NetworkHelper.exe	101
PID 3572 wrote to memory of 1992	3572	CoreSystem.exe	108
PID 4612 wrote to memory of 2332	4612	RuntimeBroker32.exe	111
PID 3836 wrote to memory of 3000	3836	NetworkHelper.exe	116
PID 4200 wrote to memory of 4072	4200	UpdateService.exe	123
PID 3848 wrote to memory of 2524	3848	ServiceHost.exe	128
PID 4276 wrote to memory of 1300	4276	InputService.exe	133

C:\Users\Admin\AppData\Local\Temp\f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe
"C:\Users\Admin\AppData\Local\Temp\f6dcf75f8a32f8d53703ec189d0bd2ba050b9ec96bbef0bcca2bb1f9459b3886.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4980

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1992

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2332

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2524

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 55fc8e1cdf129ad0a0206ec4abb9519e7ad53b812897eb11a2c62d6bb15f62c3
MD5 bc7468705f79afa8503bb51682f2b8c3
SHA1 d1ad73df3213f4e1ef816b66105eb7106ba453a1
SHA512 62b0d1b157602c7e2d3b0254567d6ea446d1d92bba31e09ac4054e612e9d2392737ff3779f65fa9ab85485231485f45a7a3e24fbd1ed6fed7e33e7938eb64e13
TLSH
T1DFD02B46A9BBA412BE72D99044D1F530740124B215E029323C2C8AAAA930569D707D64
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 9066534b093088a317bb7df20fec902d509d2b711c016a7d7600e2716cb4a79f
MD5 89d8bd33620c0cc6a7066158cc9551a9
SHA1 f358fa3cd3fc34fdc112817e3ac8489ac78de970
SHA512 d34f5dec12f5487e260ec7e5f257341e8bac0bcab006bb98e6a0b7b8c244cb330c2254529dd6dd0a1ea6c48c485a1a481aeae71d1c6e5091b2c39843fa85728d
TLSH
T1B1E0722A6B0C46843AA3CF2407E89C733C6A518964921215681897E20A426EEC30F29A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 46192fd99dd14ff84abbad0a5fe7f97bd5c0f69f6ccece10e35b752d5fdf0001
MD5 fa8c7b1c908e099bcc09dbf52a4197a4
SHA1 25dc527d3ffe7ac297410026b64a085492f91838
SHA512 224766911ec6fa418fc96f316f9a8b5883d7de4a719034c68bf651b7c65c08946c3b5efe22de9b781f6dacd936ff6eef477f3023c083ffe4271719c09771d2db
TLSH
T17F41F7D96B2C3464FF85CF8560BCC7362D7CF0806940A1A675FB84A13097FA44E0A88C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 175KB
SHA256 773121b352694c89359d8f1a20439a25a08375742d2082056a8822676c2c7d99
MD5 90a26b9fefbbc27f5424237bf25038d1
SHA1 0d853e9487a0bbb2395610e41324fa4ba77c8dbf
SHA512 59642457aad97d0be364a48d978302f6f3cb157729acac420fbdf3703167f5da90ef6de0ca48bbaa8caf51306a15856d65c5f7dd03a0ee7b56222a7b9e95855d
SSDEEP 3072:V6xnuMF+K35BgXrLCYHB4U/Am7R8sHMbhuJ4:V64u+K87WCB4U/Llsbh04
TLSH
T19E041BA85C3BB6A3AD07CF524DAEF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 4ce2b314c02b6366b457504874137b6284e8740b14cc2ef2891f3ad1f1ae681c
MD5 3d35b4e5f0f811b75f5656ee44655dd7
SHA1 72932ad0851d1363afebe2ec5c8792f3df60bff6
SHA512 3efeb928bf36877375c5ac23f54dfb264adabea2292199de8128b50a4c1218c4dbabe95d2f7588b56d06f6e631bb81190cb70fffd2713ac3c0968402c8b9fca7
TLSH
T1B341E7E75F0F7464BF05CF09AAB8C9361E38C4B492801A91B8B389D610DAB912E4A84C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 0098c2bc0da0dd0c713d47df893dc2cc2fb25d33d5a29126d5a04ccffdee387a
MD5 5b18fa9f775d749e59425c5e2a9016c0
SHA1 74c99f6fce7c0e0133690fb95139ad67dd243329
SHA512 eef46570588ede9beba00cd4f6e91a58ec20a8cc45603ec6be01f47de09652ebec006e9ec67b913d0e14aa496b785de8e6d613aa81265089b075053120b79533
TLSH
T170F0A31034FC4218D072DCBDD6E4B2AAF616F1113808DAB61D5706095B079015D59E3D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 74c7429863427face2036a5e429374f2a97478115237015ae94a355166a2bd96
MD5 ac16f150ab968c96bda44dd0126865ab
SHA1 4f96132bbc813dfe79b9a028fa5d5b8c2d5ec52a
SHA512 3c9c4c5dfbd83da313dd90509f8fd1ab474e0f9009be0a40fe355c9582aabec793ad4845c3974ffbc878d85068f111746b1721204e775a54fabae1a53c393d3f
TLSH
T163C08C2C1AA20B46F7E843BC22D139039B208151E2458F091AF22A08CDD6B272838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 4e58095d0729b900a11989b9278efdb889f37ecf8d5eb82f8a838b4c5f7069a5
MD5 2dec5b1e39c94b8074a3a2d48762d078
SHA1 12c6764735d6c6ba0571937d285496ac7fe100aa
SHA512 44350bfe5c1dfd182bda904150e17a0bdc0f55eca816db4f2e49abba34a6fd7c1d24a92c9768c206540f9410fa04c7222ad90d2d31306e06fe59feb8df7ec9b1
TLSH
T1D6F0553C1AF851BDE07ADE389FD9A7A65C15F23714044AAF1AD14B4E9B02F029C42469
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 62e705a063a6490463ec1dc02d108cbce71ebe745e083e5bc5c4c20256d6fc8e
MD5 3b20f223766dbb7a8b1240a651b13276
SHA1 00916d2be070d47b73804392ec27648278b6e4a6
SHA512 e10a4d32ca6576049ffdb7267f7cede97709b57f9e03377df5915f074986256383e63e5282c377bb917bd9f7f7814d923686783b8c68e6cb2484a470ff62303e
TLSH
T1D8F068693CFF917BF03BD9BC53C93071892AE21660422AB639F11709AF41FA0BC4160C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 bee4349b69fefb40ba0e5e6e69f4660d26cbdf812cb920f742f6b4deaef12e52
MD5 85b822f015f9f52f47218e312d0495b9
SHA1 4e9209b59d20f51eb8275186de43d953172c3a1c
SHA512 18291b1dbd602b75a505b5d937648adb2de38a5a9e4b3fc2f7cc17764c291eb3a23103d80a7b8d4f49ec682e5063dc7b3d68c5f42ccd457bc6365f600bb414b6
TLSH
T15DD0223DAB520252FAA5C23D26B506C06EB49022B0C03F186BF2304C481CE003E6380C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 592baf07007946d4f85751c267217e771a7b15d3a0f30f2a56137f04a702b76d
MD5 e432cb14f2b21edfb1e83770036cbbb6
SHA1 23ee506d6f5506f9b6ff8eaaa0f71c6923f62c97
SHA512 0622096e7cc6291463ccc7d3946b4f65806b5c12209ba3a6edad6c7c2269da587c7b18c6c4ebd60d8ccda885b1d1320d6c24d8f25b8197dfa543ed7af3d7bf70
TLSH
T182F05C3516D2401EF27236394AFD53AAED15B1563401C89416E6470AEA57E045D1053D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 215d0865c9375888c6b8ffc34f71fbc1d71e39ecf635b29fa02285fc1639b360
MD5 f72d129fc22c7b5d63c13beba44acd11
SHA1 585b60aedaed928d4296a3f34d01e42d6b3519f8
SHA512 5e9ec408bdb84c89091ba8f3f86072cb1e15a53ddbac4cbb52436ab025f001d4160d0bc5c7b4c2bd27644dca5f5f12d61d16a557f876d00ea93b7305ba63b5a8
TLSH
T187F0AB3C28EB011EF222D67C43C145D65633F63734087B9E29E10309AE46B817A62D20
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 5145ed97101d9d830b748d10acbccc6ddc3350546ffc889e1dfbea25e7015677
MD5 feaeacaa865668916c7f1633d5b5507e
SHA1 104d7f7356cc8e4262bcb9c1b9387c10149ca8d1
SHA512 c3fb64f7472279ea43ebb9ee4722195547b45bbc333fef1d1cf9306f3f44c508faf998f2bdbc7c85424d930909a6f6c10b921e89636a36a77b7ba7e2ed77e27d
TLSH
T102C08C1C06624A06F2A883B812C229838B609210F3819F0126B12A08CD25F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\InputService.exe
Size 9.1MB
SHA256 52df48e527ad263d451539f8b0af5a4790b98154da295ed88aa72b1401d8b845
MD5 6300abb66a01789549bed92b2eddaafe
SHA1 0bdd4f93a2dcde40ca0b93da53e883788c892e7e
SHA512 75cbabbd9807a19781c432c13911004255d0918e5231f203c6db56a2d89a5e884988d632ff97de98c5426e2c37440d6a3a73717710b129840849df2bc1f095a0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBp8t4C:TDpbgBr/4QAMQMrEGRONY/4VLjlB35pu
TLSH
T1D5A633EA785E6ABBC10E1C798D468D7235AC5BB2CB644CD3FFD53EB60850C521622D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe
Size 8.7MB
SHA256 fdd7352496cfe44574c6869b4acad50180beee322625b2a1e75028f16017c896
MD5 c10b19ce725b4a88a2410faecacb68fe
SHA1 cfd48c12e6bfa8e9f8c1589a85838129de72f5b4
SHA512 90fdf761a7ec92ccd24d9d75e155dbdc33906382052ee8b454413fbf18fccec50e73af9dced812486cf7497eb1d30875e9d8cadfabe5eae14b410c820006b9e3
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBp8z:TDpbgBr/4QAMQMrEGRONY/4VLjlB35pw
TLSH
T1609633EA785E6ABBC10E1C798D068D7275AC5BB2CB644CD3FFD53EB60850C531622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\NetworkHelper.exe
Size 8.8MB
SHA256 61458009e21a950adc0e8908bd6fd30c058a89fdd4d8fe2bbdce75ba6295795f
MD5 fb2483f5c5154061fb81ffc9559610a7
SHA1 5f3a397d85e83d6c97495ee5c359f72f09c5917d
SHA512 c0b8fe42bc27638c7b9a1bacc183fe5d9a12b8ca949ec3088a58345edb4a01bc96eea969fca78c1d60952099fd2ef5c6a4ed4cfba68480c472a7add89ebd2446
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBp8C:TDpbgBr/4QAMQMrEGRONY/4VLjlB35px
TLSH
T15B9633EA785E6ABBC10E1C798D068D7275AC5BB2CB644CD3FFD53EB60850C531622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
Size 8.9MB
SHA256 c4b2f65d78e908cf3ba35d4b03bdda2cdc1519d28d341a6d891d9b36de99238c
MD5 8212a7218867064100f5dd6917c3ecfc
SHA1 e00ee35e4e5e057d64440823b8418520561e56c8
SHA512 a7fa2bad143b1b22226004963b07e95418b5472a14a8c5d712d7ffded7ffd437d47a554e04c985fbed973f9a2278f56d985086d09c5fe9541a753f89edd7e535
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBp8j:TDpbgBr/4QAMQMrEGRONY/4VLjlB35pQ
TLSH
T1CD9633EA785E6ABBC10E1C798D468D7235AC5BB2CB244CD7FFD53EB60850C521622D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe
Size 8.5MB
SHA256 2f6cb1664e39b83b5c7672d11eb62b1068e607e17f773367538c5f51ab36ae1f
MD5 c16649587c8605b03cf3f9fe13518feb
SHA1 dfebee305011be76948e37fd2c0eaefc4970a860
SHA512 46564fd726ec916b9337aaf2559774c11a9c6eef9383cb0cfe45342bd21a5b2ab1a4fcade0a926b193238344282fdaa9e3cae47652c72cfceec0374e806e9dd1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBw:TDpbgBr/4QAMQMrEGRONY/4VLjlB35w
TLSH
T1709633EA785F6ABBC10E1C798D068D6275FC5BB2CB644CD7FFC53EB60850C521622922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
Size 9.2MB
SHA256 b9c525793ef33eae1b2aa2c05e69c6161c878537c329ce55d8067ca8ee0455a0
MD5 df83b7e1ce264ea16352a0e28d31620a
SHA1 0354991f91594d969f7ce57c5b00373e5fe85179
SHA512 32182d5144391461737cb065e71d25bc2ade772184d2828a351e13cd3221f5ff7f3bf473462dc584bcb75c8b4ae295c7331a528dcdc13576842ce5011032ebb9
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBp8t4J:TDpbgBr/4QAMQMrEGRONY/4VLjlB35pd
TLSH
T10CA633EA785E6AAFC10D1C798D468E7235AC5BB2CB244DD7FFC53EB60850C521622D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
Size 8.6MB
SHA256 73c6585237750dac041a1164bb2eb7a4dd72cbdb0b56714bb91d7f6a46bf979a
MD5 e3b1a38fed76fd2e62087da92e71526e
SHA1 18fb4ae1aed9754189576974e17d1ef4f96894b4
SHA512 0cb58cc21a6e3809c816cd43b8b8409660f8bd8fed13f36ac809082d7f2d94a2225ae2a62e2fdc36be6cbbc2d0b09d2619fdcbb15107848f4771e0e274706dd9
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBpz:TDpbgBr/4QAMQMrEGRONY/4VLjlB35pz
TLSH
T18F9633EA785F6ABBC10E1C798D068D6275AC5BB2CB644CC7FFC57EF60850C521622D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 9.0MB
SHA256 c8b73b0328f550e8c098e091efd54c0f6efb151b6401cda410b486394197bb45
MD5 15992379ca59fd589abe90a73ee58c26
SHA1 e3f24535eb392c657b4f6f7f8b6cb70cc38b66cd
SHA512 3a815f4f8930c6c30d5e181bcbbf660d82793c658df39d6d99942c2006298a77ebbcc0378ccfe18f095f69ef5216851d5532d8be5f60a76ca9ed51536878a29c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzN3vBp8t4f:TDpbgBr/4QAMQMrEGRONY/4VLjlB35pT
TLSH
T1659633EA785E6ABBC10E1C798D468D7235AC5BB2CB644CD3FFD53EB60850C521622D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download