fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Size 12.4MB
Sample260826-mda27stwat
SHA256 fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3
MD5 cd4d22bf610777edb26b18d77a1e1ed6
SHA1 a68eb7d7a93b0fefe7e9036fd7eb1118ecb9c7d4
SHA512 f866a20bfc49cc2b18431fdca6276d7f1e379532bf1678bda1138a76ba01699aee0ed364ad07c32795d3e2112f16c28fc60bbb1a5a3cc9436c1976233d4e6d2e
SSDEEP 196608:vsiGQmi1lviYIac3j4mlQj77dBDRK+XkuyptykFLVjzglGS1e/43WQ:vsiXmi1YB4QQjPTdvUuqyUVVSU/4GQ
TLSH
T183D6333378D19473D6AA44B11DCC0A299BB9E92364388C8B63D96D0877B4DC3D72E727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2416	sg.tmp
3440	DrvCeo.exe

Loads dropped DLL 1 IoCs

pid	Process
3440	DrvCeo.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	DrvCeo.exe
File opened (read-only)	\??\Z:	DrvCeo.exe
File opened (read-only)	\??\I:	DrvCeo.exe
File opened (read-only)	\??\K:	DrvCeo.exe
File opened (read-only)	\??\O:	DrvCeo.exe
File opened (read-only)	\??\T:	DrvCeo.exe
File opened (read-only)	\??\V:	DrvCeo.exe
File opened (read-only)	\??\W:	DrvCeo.exe
File opened (read-only)	\??\D:	DrvCeo.exe
File opened (read-only)	\??\F:	DrvCeo.exe
File opened (read-only)	\??\H:	DrvCeo.exe
File opened (read-only)	\??\P:	DrvCeo.exe
File opened (read-only)	\??\U:	DrvCeo.exe
File opened (read-only)	\??\J:	DrvCeo.exe
File opened (read-only)	\??\M:	DrvCeo.exe
File opened (read-only)	\??\N:	DrvCeo.exe
File opened (read-only)	\??\Q:	DrvCeo.exe
File opened (read-only)	\??\X:	DrvCeo.exe
File opened (read-only)	\??\Y:	DrvCeo.exe
File opened (read-only)	\??\E:	DrvCeo.exe
File opened (read-only)	\??\G:	DrvCeo.exe
File opened (read-only)	\??\L:	DrvCeo.exe
File opened (read-only)	\??\R:	DrvCeo.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c553-43.dat	upx
behavioral2/memory/3440-45-0x0000000000400000-0x0000000001431000-memory.dmp	upx
behavioral2/memory/3440-119-0x0000000000400000-0x0000000001431000-memory.dmp	upx
behavioral2/memory/3440-129-0x0000000000400000-0x0000000001431000-memory.dmp	upx
behavioral2/memory/3440-610-0x0000000000400000-0x0000000001431000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Dctempdata.drvceo	DrvCeo.exe
File opened for modification	C:\Windows\Dctempdata.drvceo	DrvCeo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DrvCeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe

Checks SCSI registry key(s) 3 TTPs 14 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	DrvCeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	DrvCeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvCeo.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	DrvCeo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	DrvCeo.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeBackupPrivilege	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeRestorePrivilege	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: 33	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeIncBasePriorityPrivilege	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: 33	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeIncBasePriorityPrivilege	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: 33	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeIncBasePriorityPrivilege	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeRestorePrivilege	2416	sg.tmp
Token: 35	2416	sg.tmp
Token: SeSecurityPrivilege	2416	sg.tmp
Token: SeSecurityPrivilege	2416	sg.tmp
Token: 33	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeIncBasePriorityPrivilege	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
Token: SeLoadDriverPrivilege	3440	DrvCeo.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe
3440	DrvCeo.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3440	DrvCeo.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3416	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe	89
PID 4740 wrote to memory of 2416	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe	91
PID 4740 wrote to memory of 3440	4740	fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe	93

C:\Users\Admin\AppData\Local\Temp\fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe
"C:\Users\Admin\AppData\Local\Temp\fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:3416
- C:\Users\Admin\AppData\Local\Temp\~7198623514171121459~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\fa398deb4685be18bc76642a6b533b720f98f64bf0a96b93e76ff0b8130b34c3.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~1020807519165138487"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\DrvCeo.exe
  "C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\DrvCeo.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DrvCeo.exe

Path C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\DrvCeo.exe
Size 3.1MB
SHA256 b243dc658f00dcdc0469a74f674b37b7b94d578f7505f84af08598c18f0ca231
MD5 9ea01a4e60fca668667d78f5cb3879c7
SHA1 26abe09312a648ea069567285f769b8a8a3f5ca0
SHA512 954c43321465ffeadb380819f555095ae863d3be19480b7a236047825155688a9afb9534bbaade27d7330a4cdbc65b410f8a4f46d0806b42af3ecef9c16c6e18
SSDEEP 98304:JlzvzDHzi5xzgPI943ZFLrXUipH5ednLIzYhm:JtfHO5xzgwG3vX5+nOd
TLSH
T186E533A54CC6E183F852C930B70965D6210BFC138D8663ABC9A9F2B24F3752E5F1D1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Drvceo.ini

Path C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\Drvceo.ini
Size 101B
SHA256 76f7641aa730b703dac426df7b7fbdcfc8353d3363c1a5cef3cd0385080d4f93
MD5 18eb2eced34c35131cf419cdc65b0519
SHA1 ca5f1b56ae63c6d003a1737f42c8d67c55556254
SHA512 34eb2470f884c6197209c87416f561011584b41589f79ff7670abe1e4cdab3443cbb8ed22565c27a6403315ad62960ecc82b5f52b1dac869336bced137b82dc2
TLSH
T175B01248658DEC78982301EC094E11943A27500D0493C979BE140AC84EC652CE46D439
MD5 SHA1 SHA512 TLSH

Submit Download

7zx86.dll

Path C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\Res\7zx86.dll
Size 1.1MB
SHA256 db2897eeea65401ee1bd8feeebd0dbae8867a27ff4575f12b0b8a613444a5ef7
MD5 e7ae42ea24cff97bdead0c560ef2add1
SHA1 866f380a62622ab1b6c7705ddc116635e6e3cc86
SHA512 a4a27b2be70e9102d95ee319ec365b0dc434d4e8cd25589ce8a75b73bbe4f06b071caa907c7a61387b2ce6a35a70873593564499b88598f77a7c25c47448fb0a
SSDEEP 24576:ax6t04DSc9S0B07sjsPEtd+F5zrtV53SePrnvgwPWrlahtN:axBOp1B07sjsPEtd2znPrnIwuh0N
TLSH
T154357D15F7F1C074CA8E45308A2DABF550F8E71ACA20A8C76780FF6E6F318D5D229959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\Res\Config.ini
Size 69B
SHA256 156981a9b3237800f3ce70f5ac8f925913817f45768cb17884a0b6a7347d1918
MD5 aec053ab1f1d0f257dd42dc10c81196d
SHA1 10c292ff26a0065c592cf574de6c27445c18d5f6
SHA512 e6f8c3baa559d9eac1fd7200132cd81496e875c4fc8e042515f1b70f725befdc4a46730af8c56b134c57d78755708cdf739586472241daecd1b0d87f14ba7784
TLSH
T1EBA002714B4464A493E631B0078518C9DFDCD81E38648DC2D7752566E19EB78670D2B4
MD5 SHA1 SHA512 TLSH

Submit Download

Netmfset.dc

Path C:\Users\Admin\AppData\Local\Temp\~1020807519165138487\Win10x64\Netmfset.dc
Size 25KB
SHA256 54fd4cae2403526df1fd51b0067a6c6beafe64403f3a56f817fe46e6cd89ea54
MD5 f054473fda83941947faeae6238213d2
SHA1 86a04d444f4966e6d7e099554c682fabd8561835
SHA512 e492c022dea088c4246d9c91bb3e919d3f4c91f17c75691f3c0079e28f58369561ea87e0c81da17cd3ec77929bb0a66ca4f5a092cc9133290d026d74b8377ffe
SSDEEP 384:ZFaE31c5TIP4YJpoI/Jg5M814u64QaRwoXDOiXNyAb6zQg1EJZ0qdXstHWX3xxxj:ZFaE31c5Tm/Jg5M814u64QU
TLSH
T1F1C2926F23352697A7813DF2C4098C03AB41E7E3DAE409B6313D31A449967C6C67FB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~7198623514171121459~\sg.tmp
Size 827KB
SHA256 48abedbe9c66cc8a9df93e15a14972dc4473fe6125bc7299eda86a99c908b742
MD5 ecb4d11b968581f9ab2a951e216288e8
SHA1 8b19d2ea9ff22e431088700526e53d02a46bebe0
SHA512 1ab719fe6455cf0539dceb7461140b727f300d7601d89a55d6d8f9d588fbfe562934a371b2dac177801596e46574f0cf6c056556a6a3bf90a6eb9491f305f1a8
SSDEEP 24576:T5Oh3oXwjoThmYgKmRCcBcIGvymfIRNM9+1uG0:Tg9ogjoVsRlBAPV+X0
TLSH
T17F05AE127BE5D0BBD2421131DA1D7BF691FA936C0B2148C763808F5D7B319D2DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dctempdata.drvceo

Path C:\Windows\Dctempdata.drvceo
Size 5KB
SHA256 514dd1171678f5f2c104146f33d4d5946f86cc113ae1da2ac4ca3f82099c01a4
MD5 1adec51ea4216b1580aaa96f2eb459fd
SHA1 68e03f012c5b4399cf3fd91c0cba1b1a5b99798f
SHA512 999e9c601fbef73bc8b37d2022903325f0a09cb9455390dc13742eb3c5454387a40845b73fe1967544bfa3ccdc43b97bc8119d83adbcef5df1522c30f0827181
SSDEEP 96:Wt4q93y/V0Wda0awWZT6gtPq0FAs2G0FABEKr0aPNjBjbB0aKOkjbB0a37QOQcjo:W6qByt0Aa0awWZnC00G02r0aPNjBfB0c
TLSH
T1B0B165E96B2A1E843BC5F7E5DC1C29404E4C460BA4FDA630B05BC6AC6C7BD26803B3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dctempdata.drvceo

Path C:\Windows\Dctempdata.drvceo
Size 6KB
SHA256 5f8ed16d16ce14fe4e96ea79f6f4cb857cc9fe6c782023806dd8ad3139df3046
MD5 122e1ac197cd170831f5f0f90a3ed22b
SHA1 1562ed6d597e9e645ac57ed5f9c010ffddd80d3c
SHA512 ed79ceb3253dca43b2f53d336d2c42f3d9a28b0e2b2aad6348162e34e3bb93914bd8cb7eafeacc2f449d4357ef289254c219194289fc9fd3bbf1a60ce5292631
SSDEEP 192:W6qByj0Aa0awWZnC00G02r0aPNjBfB0asfB0a3icfB0a3IG0a32fB0ai0a0V0a/P:W6qCQ7wMC6F7PLp7sp73icp73B732p7z
TLSH
T12DE152F96B2A1F883EC9FBE5DC1D25404D4C4A1BA4BDA630B05BC5B85977D26C02A3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dctempdata.drvceo

Path C:\Windows\Dctempdata.drvceo
Size 7KB
SHA256 96114d80cd7af556c994818bb4f6c67ad52020535eb188f3f23a822871d72f8b
MD5 be070f2a5b7d6f60ae795e10e7fdd0a4
SHA1 311c7f1c0dcbe4cf39323dc4cdac34b9f1685eca
SHA512 d288da290207763928ae4d778a963fc7909e8d9a986044e20644719d5afb34b5b8061d157e6d6676ae77b87faf55e2ff0d01b009ad308e4af78adb1725d07c11
SSDEEP 192:W6qByr0Aa0awWZnC00G02r0aPNjBfB0asfB0a3icfB0a3IG0a32fB0ai0a0V0a/U:W6q2Q7wMC6F7PLp7sp73icp73B732p7w
TLSH
T12DF173F96B2A5F883EC9FBD8DC1C25804A4C461BA5BDA630B05BC5A85D77D26C02B3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DrvCeoRun26.0826.log

Path C:\Windows\Temp\~DrvCeoLog\DrvCeoRun26.0826.log
Size 1KB
SHA256 a305c5691f539b7bfd1ea2a460fc124e61394c3a6c5e2da99a5c17b4b7fe62b3
MD5 c96c12b33338ab6ce839645acfc44d16
SHA1 699d384adde01f9b6796180ba6c9abc0761b1b94
SHA512 beb78f6a5334c8d95e9132005fe6604a9fb0c54564f50cf25248f3ca065a9ce04c0fb3edd4687f6ab0cbc9aa1411d0544ccc997781a6928256ded8b7ffe0972e
TLSH
T17E41596DD2F78A5E2E1222089A247D89A53331153EFD37642734A4086BEEB1CDBE5331
MD5 SHA1 SHA512 TLSH

Submit Download

DrvCeoRun26.0826.log

Path C:\Windows\Temp\~DrvCeoLog\DrvCeoRun26.0826.log
Size 4KB
SHA256 7cfb583de510ead65f93c373883baaedc4e82d60b1fbc5b4b248b6fd1859ad52
MD5 78cf7eff9d2d99b4075ba281e57a23be
SHA1 377c7b24148a20c47d0df2f9d97e22d22ace87b6
SHA512 308f0a120d6f7110be7a54705dbc789ef9d1d3f043cd59ace8b7cdaadf0c3cd9e5e9e4b00e2fa7413e252bc863015c120af747002f4460435687a2d36cbb6834
SSDEEP 96:Ku8k5OjZWCZPvHWl9Ak6k65KSmZ65FWZ6WFE8zYrGZPZmQk7TrMXeCjb7pPlZ6yq:N8k5Os8vHWrLz65KSjF4E8iLQk7TrMXA
TLSH
T17391D4ADC1FA490A0E136145B5192D8AA2B3365525FC37AC37347044AADEB4CDEE8732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoInIndex.log

Path C:\Windows\Temp\~DrvCeoLog\NoInIndex.log
Size 42KB
SHA256 dff030f5913faf71b48f54e600f41c43d23a4e8fc24e2e9c5d29798921517f9e
MD5 a1a3d04605636fb231e22ed63c920684
SHA1 57ff5d7e713cd5ac3f2ab74697f92ab80fc28f69
SHA512 880abae8afc0a9b091c94d07fe4c9e35a472fe0951896516f3c02c61ae57817cae460ff21e9e186e60d876f9e659826ead54375c07582c0727bfcb718a38774f
SSDEEP 768:K6T1fmo6qxByXMpMBkGKzMZNzMZozMZ0zMZx:K/MmBkGKzMZNzMZozMZ0zMZx
TLSH
T15E130F17C1514761BF128283B8E73E617525716F23C5289788BBEA4B8FCB3CD9BD2909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoInIndex.log

Path C:\Windows\Temp\~DrvCeoLog\NoInIndex.log
Size 50KB
SHA256 ad3da47815a15c57d8c7c02b7aa1386b38b2580551b1b48a3d8fcddd8b3e69ed
MD5 51963dafb6b28f368ee0d732d5e89c26
SHA1 70bf100b27ae1c35ed6ceab4a4857dd87bc2c99a
SHA512 8a32e000e4a247a11a14c36e31a64b78be73ce5a0da4c255868bff6281c78bc47cc23f83d69ee122fce72288d742b9a04c2cef1a1a167e94af171495b159ef52
SSDEEP 768:K6T1fmo6qxByXMpMBkGKzMZNzMZozMZ0zMZNLN:K/MmBkGKzMZNzMZozMZ0zMZv
TLSH
T151332213C15147A1EF428183B8E73E61B526716F23C5289788BBEA474FCB3DD9BD2909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoInSys.log

Path C:\Windows\Temp\~DrvCeoLog\NoInSys.log
Size 809B
SHA256 b06c2244d0962c4e08b1b6b2b9fb4145a74a4a7a55b117fa3dfccf6dc9be619a
MD5 20bea074af79833b79cba1dc2aa1b971
SHA1 be1940eb5f4fd73025c7e9c1ca55c766421d27fe
SHA512 9e987b571f02c878abfbc91fcb5f244199aede2c9c55e30ff6fceddf9f33e4082715396d97e7c79694931cf737020e1dfc626d5e13a3b782078d86a360f3932b
TLSH
T1EE014714C381879F1C8A2115AE7138D4EF2828097FE23D191A11C998CEC9B34DAEAA24
MD5 SHA1 SHA512 TLSH

Submit Download

PcHighDrv.log

Path C:\Windows\Temp\~DrvCeoLog\PcHighDrv.log
Size 809B
SHA256 63d59297c98d238fc25a8d080b427fbbbd2671908aef2cf645ed734b8a88344a
MD5 07d79b721a5a8cd3f3bdd71901ed8773
SHA1 cc2ed3205debcc268fbda07cc0e6bd81e452db22
SHA512 2138affe8fd9a8f4f05ae64837f4eec150d246019f4d646e11ccc1d5bb8acce71a6c814abd0d668fb395ca1cb352e02cc409721d15a1f2df7448755c0885d5d6
TLSH
T177017B10C381D78F1C8A21159E7138D4EF2428097FE27D191E11C99CCFC9B35DAFAA24
MD5 SHA1 SHA512 TLSH

Submit Download

PcHwids.log

Path C:\Windows\Temp\~DrvCeoLog\PcHwids.log
Size 50KB
SHA256 021ff83b42fa7719b7f35d128de045ee1ad384c94bd21b0e2e67883b1f263182
MD5 a15d9fa7a6d55b387b94fc951fdaa048
SHA1 36c6619cc346731c1e5a06d79d2b1d5ea11744b9
SHA512 896c7c88f1d2b0c3afed5a2dc2926cbd67cc2b4f52e01c9bd93d1f41e7368d52bdba69d1c21aa5cd76ce15810114015b4e27e2d4896b6f5b2cdedd1d36843259
SSDEEP 768:1qQOBq8zMZbzMZNzMZMzMZtMhxom6Bf1yTJsBh:oQOBq8zMZbzMZNzMZMzMZtMk
TLSH
T1D9332213C15147A1EF428183B8E73E61B526716F23C5289788BBEA474FCB3DD9BD2909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3440-129-0x0000000000400000-0x0000000001431000-memory.dmp

Download

memory/3440-45-0x0000000000400000-0x0000000001431000-memory.dmp

Download

memory/3440-46-0x0000000003D80000-0x0000000003D81000-memory.dmp

Download

memory/3440-121-0x0000000003D80000-0x0000000003D81000-memory.dmp

Download

memory/3440-119-0x0000000000400000-0x0000000001431000-memory.dmp

Download

memory/3440-610-0x0000000000400000-0x0000000001431000-memory.dmp

Download

memory/4740-0-0x0000000000400000-0x0000000000586000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads