Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 08:35
Behavioral task
behavioral1
Sample
xoilacda.com_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
40 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilacda.com_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
38 signatures
150 seconds
General
- Target xoilacda.com_chrome.exe
- Size 57KB
- Sample260907-khb4yssfmc
- SHA256 0545990f1d25d83e143c52ccd64e0ad86554c2a54730c202a9624545635b1452
- MD5 ceb451eb8acede64ea474154503b19cc
- SHA1 4031c30e21202e119d4639c625c85d1c4bbdb2e8
- SHA512 1478f828c8287e19530d9cd7620ed47570b68e98020b863e71f2729df3f9ec8c6ab50bba37f63cb7aea6a0eba0a8fe725cc5de60431c6492d7a96cccad1249e9
- SSDEEP 768:fSZGQqu06P10I9ELNn2karVRdcYMg4iN1XXGb5fAdOTAKFum1h:fQjP11CwrV3J34iLXGb5feOTAuuO
- TLSH T1AF43F84477FD4111E2BF8EBA4DB1A1518B32B8A76D32D78D06D4068E19B2B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilacda.com
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilacda.com
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3768-1-0x0000000000B60000-0x0000000000B74000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilacda.com_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 6196 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilacda.com_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilacda.com_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe xoilacda.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe xoilacda.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe xoilacda.com_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4856 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf xoilacda.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf xoilacda.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf xoilacda.com_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1976 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe xoilacda.com_chrome.exe File created C:\Windows\system32\sysupdate.exe xoilacda.com_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilacda.com_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 2236 wscript.exe 5072 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilacda.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" xoilacda.com_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4556 sc.exe 3972 sc.exe 4808 sc.exe 1828 sc.exe 4792 sc.exe 684 sc.exe 4868 sc.exe 2556 sc.exe 4544 sc.exe 3564 sc.exe 4780 sc.exe 2892 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3048 cmd.exe 5784 cmd.exe 4280 cmd.exe 4900 cmd.exe 5840 cmd.exe 6808 cmd.exe 3104 cmd.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5364 NETSTAT.EXE 5488 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5740 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5256 vssadmin.exe 1044 vssadmin.exe 2572 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilacda.com_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe\" \"%1\"" xoilacda.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilacda.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell\open xoilacda.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilacda.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings xoilacda.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell xoilacda.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilacda.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell\open\command xoilacda.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilacda.com_chrome.exe" xoilacda.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell\open\command xoilacda.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\shell\open xoilacda.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings xoilacda.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilacda.com_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3356 schtasks.exe 7156 schtasks.exe 2856 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6196 powershell.exe 6196 powershell.exe 6196 powershell.exe 3104 WMIC.exe 3104 WMIC.exe 3104 WMIC.exe 3104 WMIC.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 4100 WMIC.exe 4100 WMIC.exe 4100 WMIC.exe 4100 WMIC.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3192 WMIC.exe 3192 WMIC.exe 3192 WMIC.exe 3192 WMIC.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe 3768 xoilacda.com_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3768 xoilacda.com_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 6196 powershell.exe Token: SeIncreaseQuotaPrivilege 3104 WMIC.exe Token: SeSecurityPrivilege 3104 WMIC.exe Token: SeTakeOwnershipPrivilege 3104 WMIC.exe Token: SeLoadDriverPrivilege 3104 WMIC.exe Token: SeSystemProfilePrivilege 3104 WMIC.exe Token: SeSystemtimePrivilege 3104 WMIC.exe Token: SeProfSingleProcessPrivilege 3104 WMIC.exe Token: SeIncBasePriorityPrivilege 3104 WMIC.exe Token: SeCreatePagefilePrivilege 3104 WMIC.exe Token: SeBackupPrivilege 3104 WMIC.exe Token: SeRestorePrivilege 3104 WMIC.exe Token: SeShutdownPrivilege 3104 WMIC.exe Token: SeDebugPrivilege 3104 WMIC.exe Token: SeSystemEnvironmentPrivilege 3104 WMIC.exe Token: SeRemoteShutdownPrivilege 3104 WMIC.exe Token: SeUndockPrivilege 3104 WMIC.exe Token: SeManageVolumePrivilege 3104 WMIC.exe Token: 33 3104 WMIC.exe Token: 34 3104 WMIC.exe Token: 35 3104 WMIC.exe Token: 36 3104 WMIC.exe Token: SeBackupPrivilege 4224 vssvc.exe Token: SeRestorePrivilege 4224 vssvc.exe Token: SeAuditPrivilege 4224 vssvc.exe Token: SeIncreaseQuotaPrivilege 3104 WMIC.exe Token: SeSecurityPrivilege 3104 WMIC.exe Token: SeTakeOwnershipPrivilege 3104 WMIC.exe Token: SeLoadDriverPrivilege 3104 WMIC.exe Token: SeSystemProfilePrivilege 3104 WMIC.exe Token: SeSystemtimePrivilege 3104 WMIC.exe Token: SeProfSingleProcessPrivilege 3104 WMIC.exe Token: SeIncBasePriorityPrivilege 3104 WMIC.exe Token: SeCreatePagefilePrivilege 3104 WMIC.exe Token: SeBackupPrivilege 3104 WMIC.exe Token: SeRestorePrivilege 3104 WMIC.exe Token: SeShutdownPrivilege 3104 WMIC.exe Token: SeDebugPrivilege 3104 WMIC.exe Token: SeSystemEnvironmentPrivilege 3104 WMIC.exe Token: SeRemoteShutdownPrivilege 3104 WMIC.exe Token: SeUndockPrivilege 3104 WMIC.exe Token: SeManageVolumePrivilege 3104 WMIC.exe Token: 33 3104 WMIC.exe Token: 34 3104 WMIC.exe Token: 35 3104 WMIC.exe Token: 36 3104 WMIC.exe Token: SeIncreaseQuotaPrivilege 6196 powershell.exe Token: SeSecurityPrivilege 6196 powershell.exe Token: SeTakeOwnershipPrivilege 6196 powershell.exe Token: SeLoadDriverPrivilege 6196 powershell.exe Token: SeSystemProfilePrivilege 6196 powershell.exe Token: SeSystemtimePrivilege 6196 powershell.exe Token: SeProfSingleProcessPrivilege 6196 powershell.exe Token: SeIncBasePriorityPrivilege 6196 powershell.exe Token: SeCreatePagefilePrivilege 6196 powershell.exe Token: SeBackupPrivilege 6196 powershell.exe Token: SeRestorePrivilege 6196 powershell.exe Token: SeShutdownPrivilege 6196 powershell.exe Token: SeDebugPrivilege 6196 powershell.exe Token: SeSystemEnvironmentPrivilege 6196 powershell.exe Token: SeRemoteShutdownPrivilege 6196 powershell.exe Token: SeUndockPrivilege 6196 powershell.exe Token: SeManageVolumePrivilege 6196 powershell.exe Token: 33 6196 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3768 xoilacda.com_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3768 wrote to memory of 6196 3768 xoilacda.com_chrome.exe 90 PID 3768 wrote to memory of 1828 3768 xoilacda.com_chrome.exe 92 PID 3768 wrote to memory of 2556 3768 xoilacda.com_chrome.exe 94 PID 3768 wrote to memory of 4792 3768 xoilacda.com_chrome.exe 96 PID 3768 wrote to memory of 684 3768 xoilacda.com_chrome.exe 98 PID 3768 wrote to memory of 4544 3768 xoilacda.com_chrome.exe 100 PID 3768 wrote to memory of 3564 3768 xoilacda.com_chrome.exe 102 PID 3768 wrote to memory of 4780 3768 xoilacda.com_chrome.exe 104 PID 3768 wrote to memory of 2892 3768 xoilacda.com_chrome.exe 106 PID 3768 wrote to memory of 4252 3768 xoilacda.com_chrome.exe 107 PID 3768 wrote to memory of 4556 3768 xoilacda.com_chrome.exe 109 PID 4252 wrote to memory of 5136 4252 fodhelper.exe 111 PID 3768 wrote to memory of 3972 3768 xoilacda.com_chrome.exe 112 PID 3768 wrote to memory of 5256 3768 xoilacda.com_chrome.exe 114 PID 3768 wrote to memory of 3104 3768 xoilacda.com_chrome.exe 137 PID 3768 wrote to memory of 2236 3768 xoilacda.com_chrome.exe 123 PID 3768 wrote to memory of 3356 3768 xoilacda.com_chrome.exe 124 PID 3768 wrote to memory of 7156 3768 xoilacda.com_chrome.exe 126 PID 3768 wrote to memory of 4900 3768 xoilacda.com_chrome.exe 131 PID 3768 wrote to memory of 4280 3768 xoilacda.com_chrome.exe 133 PID 3768 wrote to memory of 5784 3768 xoilacda.com_chrome.exe 134 PID 3768 wrote to memory of 5840 3768 xoilacda.com_chrome.exe 135 PID 3768 wrote to memory of 3048 3768 xoilacda.com_chrome.exe 136 PID 3768 wrote to memory of 3104 3768 xoilacda.com_chrome.exe 137 PID 3768 wrote to memory of 6808 3768 xoilacda.com_chrome.exe 138 PID 3768 wrote to memory of 2856 3768 xoilacda.com_chrome.exe 144 PID 3768 wrote to memory of 5072 3768 xoilacda.com_chrome.exe 147 PID 4900 wrote to memory of 1044 4900 cmd.exe 148 PID 6808 wrote to memory of 5364 6808 cmd.exe 149 PID 4280 wrote to memory of 5740 4280 cmd.exe 150 PID 5784 wrote to memory of 1976 5784 cmd.exe 151 PID 5840 wrote to memory of 4176 5840 cmd.exe 152 PID 3104 wrote to memory of 5488 3104 cmd.exe 153 PID 3048 wrote to memory of 3460 3048 cmd.exe 154 PID 3460 wrote to memory of 4920 3460 net.exe 155 PID 4900 wrote to memory of 4100 4900 cmd.exe 156 PID 3768 wrote to memory of 5796 3768 xoilacda.com_chrome.exe 157 PID 3768 wrote to memory of 2572 3768 xoilacda.com_chrome.exe 158 PID 3768 wrote to memory of 3192 3768 xoilacda.com_chrome.exe 159 PID 3768 wrote to memory of 3256 3768 xoilacda.com_chrome.exe 160 PID 3768 wrote to memory of 4856 3768 xoilacda.com_chrome.exe 161 PID 3768 wrote to memory of 4868 3768 xoilacda.com_chrome.exe 162 PID 3768 wrote to memory of 4808 3768 xoilacda.com_chrome.exe 163 PID 3256 wrote to memory of 5600 3256 net.exe 170 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6196
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1828
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2556
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4544
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3564
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4780
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2892
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe"3⤵PID:5136
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4556
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3972
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5256
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2236
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3356
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:7156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1044
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5740
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:1976
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\system32\whoami.exewhoami3⤵PID:4176
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4920
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5488
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6808 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:5364
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2856
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5072
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5796
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2572
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5600
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4856
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4868
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4808
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe1⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilacda.com_chrome.exe1⤵PID:5548
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260907_093730.jpg
- Size 114KB
- SHA256 ca000b0cd47b1d1a1607dc553c116405e27ca703fb76aaf56772d97487082164
- MD5 87a0272a662c32913201f34d23ae15c2
- SHA1 df1fd42d3f55e7403e5fbbf68da466f2b3bf2047
- SHA512 3e1f24fe7aac81f1ddf84c9e8c48881362b895d8eccdd178d5308b8878933a2e280e9ce7cefe604cd972eef93318ec803b087eec03d7d5b92d1009a2fef9bb80
- SSDEEP 1536:SXlxf8VzBj4JDv7Cf5Q7eehGQdKvTYiTvRESxNuuJyadn2f4TykSSSSSSSSSSSSl:UXf8VzBEJqk1VcvDqSDu6y8BTfF
- TLSH T1FAB3FF038D089B47A05887ECBD434E7C2B5A5B5DE99376FF05725ECB3E612621C8E06E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 76KB
- SHA256 11018e9ee0b7ad5c95c9ca096898fae53d59210c887900417e9e7e26643ae14c
- MD5 fd0eb884b8722d2a175073b229897c96
- SHA1 2654ad2818820d149ed2f25d459f47b75253b3b2
- SHA512 7b5a52de56f777ce4acb31542bedd8ddfcae3e79cb517a0f850c627f25727a8b1cce5016e96f2c6f6c56ca1d52cdd918389f816b4147cef52993b6ed52d9b9b2
- SSDEEP 1536:IOjZTsn/9q1zOtQXKbLRFhyqw4JI9OVdIeVpK1OXMuvc140zzOCJVQwGKP48+:IOjZ+lqd9Xavw42EVdIGsyDUe0zzlQDZ
- TLSH T1E77339368F22FCD4677E3D80E0103A961C893E6787B5767CFA860DA62AA5540CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 76KB
- SHA256 3ae57700e08617d244856bc6321cc7dd883962c2de47a1e32a759e770c3881ef
- MD5 4ce36ac38073185c3c6e312d0f5f658c
- SHA1 78a68413752a19e553286e8a8d1cdcd41abb8f29
- SHA512 04bfe410e08baef3983e3bea155f47a820b80868b5ba56de87b8a9b764ebf6f5c29175ccb13de04e2921411cc9f8dd9874514d6bccbadbee2827402565569ab7
- SSDEEP 1536:oOjZTsn/9q1zOtQXKbLRFhyqw4JI9OVdIeVpK1OXMuvc140zzOCJVQwGKP485:oOjZ+lqd9Xavw42EVdIGsyDUe0zzlQDw
- TLSH T1227329368F23FCD4277E3D80E0103A961C893E6B8775667CFA860DA62AA5540DF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 244B
- SHA256 f034af21dcf79281e3c5066e7ab62bb6704f8de208c8ec72f4ca1792bd013a07
- MD5 137a21220f33bcbf5138b6b448d0f122
- SHA1 798471e62d3dd96518ff589293edb4c4dc026568
- SHA512 488340dbd19aa566f91a1ffe95221c107a9bbe8e6cc886ddbc96e682cc110912e2e14fbe1e2330efc94795c1115200b7174070dc97b69e6006e016e1bb464d47
- TLSH T182D0A78FB248C6B90001127F81F3CD4DE9E558683B13BEE09AA5DD4D32918868DF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 245B
- SHA256 21d014830ef260a89c2786a4cc83fc09af201c9ed1db897a3dc73d09f4bbd522
- MD5 a3932189f41f153e0385fe8a5c99b1be
- SHA1 46c062cdcfab3eb9b10bf326b01a9536ab170fbb
- SHA512 abbdc25fb0a7fd67e1ffbb948cdd1a9f29bc05fc2d2727344697f7f73d124f601693dee42e801cc1928aeee45361c3ac57504036ef046ee015db02799c6c6c3f
- TLSH T19ED0A78FB248C6B90001127F80F3CD4DEAE158683F13AEA09AA5DD0E32818868DF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 153KB
- SHA256 635124438fac87c789019a14faf787e226009434d5e2f0734be2be6e34696c36
- MD5 76ffe70fdc2a8b74de47e368c01037c9
- SHA1 19c60885b9811305a856a67da92aa090bd7a6d35
- SHA512 5f612a9cc2d618e0bb1a4360aa0ea888557eca890c4c34fc40a697686cbf4a16196dd4f96da82b093386d482869cced210e2f3e03e95bd127145476d2607309f
- SSDEEP 1536:C8OD4x9+KTWDBDo8DI/VwTE9opZwDWqqqJuEBoV5ZaGSAFY70TDb:CvD4GKT+jDCwTEYZwDWqzJJofjFv
- TLSH T108E35611C6B39E6A45914AAB181673D0B438B7B5C2EC84FF21B6AE73F0738B2C34D651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 153KB
- SHA256 c96e114df8a67f6b0ab4211250f4429cf76dc10cc3ec38ea388302648bbf14f5
- MD5 08290619cb7f6efd2f55e120a5c4e846
- SHA1 2cfbd40c6d0b64d1e38f5d9c9b5f18809db08a6b
- SHA512 87c1c6eeab22564705d0859dfa8605b92881f8f6cc5bc35fd88d31c28c12350802e535f0782473677702a1539c6d87876fd38ce67059f48390502231e5be0709
- SSDEEP 1536:D8OD4x9+KTWDBDo8DI/VwTE9opZwDWqqqJuEBoV5ZaGSAFY70TDu:DvD4GKT+jDCwTEYZwDWqzJJofjFi
- TLSH T1CFE35611C6B39E6A45914AAB181673D0B438B7B5C2EC84FF21B6AE73F0738B2C34D655
- MD5 SHA1 SHA512 SSDEEP TLSH