agenttesla | c571da34ec2edce2816ff4092ab21abc6250a6c410ee1f54586f2170a2d5010f

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MR-2026-135.MSI.msi
Size 564KB
Sample260929-rn3x7asapb
SHA256 c571da34ec2edce2816ff4092ab21abc6250a6c410ee1f54586f2170a2d5010f
MD5 1e92dfdabae073364ad634f7b5f3d365
SHA1 96b89670e9ed749327fb4b3ff114d320ec86180b
SHA512 ccbade66dd2d241613c3bac9f264fe660b9536adb5e86863f407353aab175f5245d223dc2fd9424c728bc9b65919bdd52709b791da18154faf387c13ce82a845
SSDEEP 6144:mFG6Ug4yDf0/Bu08rKS932ZH1olrr0D+0xKZdQkOgwPTXy95GqJGwebcANDVtdnS:mQUHf+DmpodUwPTXs5GlL6VUTxjWD7
TLSH
T138C42313B3629827D8534736CF9F4AF80E37AC660757DA161A05BB9C7EB315103268F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
s4=O8tsknbClU8b_
Email to
[email protected]

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 1 IoCs

pid	Process
1960	GWRKAJVJWDMRYLNB.EXE

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	GWRKAJVJWDMRYLNB.EXE

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1960	GWRKAJVJWDMRYLNB.EXE
1960	GWRKAJVJWDMRYLNB.EXE

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF1B63FD3211905F98.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF856471B5DC992DB6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D41.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2B6BEFB79E29316B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF64CB3EFD9770724C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e591f84.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1CF63E7126859220.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24C4.tmp	msiexec.exe
File created	C:\Windows\Installer\e591f86.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A119A541-66BD-4D84-BCF1-4EBCB552E069}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67DCD56962DD7CAD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCBAC13DAF8577103.TMP	msiexec.exe
File created	C:\Windows\Installer\e591f84.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4648	msiexec.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3664	cmd.exe
5876	cmd.exe
5596	cmd.exe
1496	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GWRKAJVJWDMRYLNB.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GWRKAJVJWDMRYLNB.EXE

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GWRKAJVJWDMRYLNB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
1960	GWRKAJVJWDMRYLNB.EXE
1960	GWRKAJVJWDMRYLNB.EXE
1960	GWRKAJVJWDMRYLNB.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4648	msiexec.exe
Token: SeSecurityPrivilege	4952	msiexec.exe
Token: SeCreateTokenPrivilege	4648	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4648	msiexec.exe
Token: SeLockMemoryPrivilege	4648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4648	msiexec.exe
Token: SeMachineAccountPrivilege	4648	msiexec.exe
Token: SeTcbPrivilege	4648	msiexec.exe
Token: SeSecurityPrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeLoadDriverPrivilege	4648	msiexec.exe
Token: SeSystemProfilePrivilege	4648	msiexec.exe
Token: SeSystemtimePrivilege	4648	msiexec.exe
Token: SeProfSingleProcessPrivilege	4648	msiexec.exe
Token: SeIncBasePriorityPrivilege	4648	msiexec.exe
Token: SeCreatePagefilePrivilege	4648	msiexec.exe
Token: SeCreatePermanentPrivilege	4648	msiexec.exe
Token: SeBackupPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeShutdownPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	4648	msiexec.exe
Token: SeAuditPrivilege	4648	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4648	msiexec.exe
Token: SeChangeNotifyPrivilege	4648	msiexec.exe
Token: SeRemoteShutdownPrivilege	4648	msiexec.exe
Token: SeUndockPrivilege	4648	msiexec.exe
Token: SeSyncAgentPrivilege	4648	msiexec.exe
Token: SeEnableDelegationPrivilege	4648	msiexec.exe
Token: SeManageVolumePrivilege	4648	msiexec.exe
Token: SeImpersonatePrivilege	4648	msiexec.exe
Token: SeCreateGlobalPrivilege	4648	msiexec.exe
Token: SeBackupPrivilege	5708	vssvc.exe
Token: SeRestorePrivilege	5708	vssvc.exe
Token: SeAuditPrivilege	5708	vssvc.exe
Token: SeBackupPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4648	msiexec.exe
4648	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4648	msiexec.exe
4952	msiexec.exe
4676	msiexec.exe
1960	GWRKAJVJWDMRYLNB.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4672	4952	msiexec.exe	94
PID 4952 wrote to memory of 3664	4952	msiexec.exe	96
PID 4952 wrote to memory of 4676	4952	msiexec.exe	98
PID 4952 wrote to memory of 1960	4952	msiexec.exe	99
PID 1960 wrote to memory of 5876	1960	GWRKAJVJWDMRYLNB.EXE	101
PID 5876 wrote to memory of 5316	5876	cmd.exe	102
PID 1960 wrote to memory of 5596	1960	GWRKAJVJWDMRYLNB.EXE	103
PID 5596 wrote to memory of 2680	5596	cmd.exe	104
PID 1960 wrote to memory of 1496	1960	GWRKAJVJWDMRYLNB.EXE	105
PID 1496 wrote to memory of 3388	1496	cmd.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	GWRKAJVJWDMRYLNB.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MR-2026-135.MSI.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  cmd.exe /c if /i "YES"=="YES" if not exist "GWRKAJVJWDMRYLNB.mui" echo %RANDOM%%RANDOM%%RANDOM%> "GWRKAJVJWDMRYLNB.mui"
  2⤵
  - Executes a command shell one-liner
  PID:3664
- C:\Windows\system32\msiexec.exe
  msiexec.exe /x {A119A541-66BD-4D84-BCF1-4EBCB552E069} /qn /norestart
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4676
- C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\GWRKAJVJWDMRYLNB.EXE
  "C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\GWRKAJVJWDMRYLNB.EXE" "C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\GWRKAJVJWDMRYLNB.ttf"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c whoami
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Windows\SysWOW64\whoami.exe
      whoami
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "GWRKAJVJWDMRYLNB" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "GWRKAJVJWDMRYLNB"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "GWRKAJVJWDMRYLNB" /tr "cmd /c \"C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\BNLYRMDWJVJAKRWG.url\"" /ru "szapmtop\admin" /f /it
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 15 /tn "GWRKAJVJWDMRYLNB" /tr "cmd /c \"C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\BNLYRMDWJVJAKRWG.url\"" /ru "szapmtop\admin" /f /it
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591f85.rbs

Path C:\Config.Msi\e591f85.rbs
Size 8KB
SHA256 1b4a8863f34dd3c93cb42568c83d77c017907ab090432d8b8392a64042a631fa
MD5 f96e77046c4c0b62df298bff7e05f482
SHA1 8b6280b20eca9ce106699f88397f0b4796b57cc6
SHA512 ef2886c56ab363b169fc6e14e69a5b4c04663fdd4ec583d11e42297c252648410fb3e9fc23fb633cd80c96485ca11231f8079f78d69ba80b91afc78bff6d2963
SSDEEP 96:9Z9WyZpkpaCQs7ZUtKi/TCOThqXbUtKi/TCgjwBS5ThqX2HmtMjq+FjCOgctC1pQ:9XpkpaCLSJOGtJO8nc1pQ
TLSH
T10E02FD01B54081D2F8591B36871777517FBAF3FD821262CF698A84788E0279C9EEC1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591f89.rbs

Path C:\Config.Msi\e591f89.rbs
Size 7KB
SHA256 1836fc4fa16ab614a392041ab4c330b7808d2826d13a82170d589b44263046bb
MD5 d9b2aa14f475e7386b52c0e41833cc3e
SHA1 516a93104c7aab33cafaf064b8808997746e5a53
SHA512 a1e3b3c1515c6221f58c529da004f3a853e83c3882f4b63590649ec41408b321884047760d53f0d26d400b4495e7b5e85bb7ca4a6f01052150ff0524ab6ff3a2
SSDEEP 96:aZzsJ8S28ReidHWjX2t8ReedHWIjxzXBSbSgX2pIHLto/BLtXwsjCMOBxhvQ7fXU:aRkRJWlRNWIXwuB7Pzo
TLSH
T10EF10102F1548192FC591B368B1776A17FEBE3FD871692CF608E88A48A0175C9AEC1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GWRKAJVJWDMRYLNB.exe

Path C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\GWRKAJVJWDMRYLNB.exe
Size 499KB
SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
MD5 7675b38aabebc8427171447edd484b5b
SHA1 145c72f8acdcd366869f955dffd000d3bc146b6e
SHA512 bc9bddbee59f165742a3203f9e2ba9de409e66de6334cb352cded84cce3e1074dbd0ac17b29e58c8729906848b64d1486fb8c848ca15422127b2baeb4c5e5dbe
SSDEEP 12288:HW7YOPcqPqvopYJNWGIbK8AJYlqWuSr7B/Uj:HW7RPcqPqvopYJYK8AyldpUj
TLSH
T176B43AC4BACB08F1E2A355B0C49BDB7F96349A050022D5BAFF5CBD59EC33746092725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GWRKAJVJWDMRYLNB.mui

Path C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\GWRKAJVJWDMRYLNB.mui
Size 17B
SHA256 f848d8aacea0773002d09a4917f4b8dedc296f583d20dc2a0593561805003fb7
MD5 eec810aa90db2bd7f10469bc28fd3a73
SHA1 22534cfe8fe3e14b504f8505beda1cfd1f15f7d0
SHA512 ffa1c974ff455057661ba704cd2cdc452149e405b77ed3f36793458c704d8f572ddbc5325c5874230f5dcdadfdeafbc2115e29fdb83fccab60ec539b4fb0b654
MD5 SHA1 SHA512

Submit Download

GWRKAJVJWDMRYLNB.ttf

Path C:\Users\Admin\Documents\GWRKAJVJWDMRYLNB\GWRKAJVJWDMRYLNB.ttf
Size 545KB
SHA256 bcf886dcbf0becb78f44efbd7805b0c40996340d300dfddf863aa5dda4c23fdd
MD5 15fff99017840ad324383a4dc2b56d7d
SHA1 0d6ad5e8d69ec4d310c71655813e97463dd823a6
SHA512 13ce114bbe3565f1a09e875f551bce53140a72213d1e48e7437e616eec180283786b45b39fb5acfe97f6a5158e6ba5c43386ee5e47566d3c952cb77a3db0d13f
SSDEEP 6144:ZcfmZ2LO/5icQsPI897QRwUbH377fUtK0Qef6RnjxCxxMkG49J5Iu0NhaDiyk:Zt2LMxjjPoX77aK0nSpobJUu0NoDiyk
TLSH
T1E0C48D8BF5C71D9466E142F0CCA79EDB74B5D4EE0B0E06425FA8D0956B203BC85F883A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e591f86.msi

Path C:\Windows\Installer\e591f86.msi
Size 564KB
SHA256 c571da34ec2edce2816ff4092ab21abc6250a6c410ee1f54586f2170a2d5010f
MD5 1e92dfdabae073364ad634f7b5f3d365
SHA1 96b89670e9ed749327fb4b3ff114d320ec86180b
SHA512 ccbade66dd2d241613c3bac9f264fe660b9536adb5e86863f407353aab175f5245d223dc2fd9424c728bc9b65919bdd52709b791da18154faf387c13ce82a845
SSDEEP 6144:mFG6Ug4yDf0/Bu08rKS932ZH1olrr0D+0xKZdQkOgwPTXy95GqJGwebcANDVtdnS:mQUHf+DmpodUwPTXs5GlL6VUTxjWD7
TLSH
T138C42313B3629827D8534736CF9F4AF80E37AC660757DA161A05BB9C7EB315103268F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 88c498a22505ee19aa03fbc596154b9d0ed3fd6272ada1519eb6dcbac26d89af
MD5 f2c3e78382d3939f69a349e16144f504
SHA1 bee8d8ce20f8b251a961cbbe1cbb0a23bc304e81
SHA512 6deae2c2f46bd9701ae1eb5dbc3cd84ccc262bf9d074e0378c1b4f450a2c81aa367bb1001422dc6a2fbb8a0b236d7ff6707d1de8eb04089a4d3d225e6cdf752e
SSDEEP 24576:ZFo3DMPkdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+3:oHE
TLSH
T16557B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{770f8f08-a33b-4c75-b60b-568fc447646e}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{770f8f08-a33b-4c75-b60b-568fc447646e}_OnDiskSnapshotProp
Size 6KB
SHA256 654088ea4789532798fc2028f64a009856cf2bdc5690f47373dac34dc9a1032b
MD5 00cdc0f5225239072dec5f51708b11ac
SHA1 3e7590b4ccfed6aba12ccc51683f57cc274d7b26
SHA512 a5c39c126ae12e148138f495ed5133dbe31ad37eceb29f78ef4aafafbf26b7984ec2950273f78218b77a147a60516e9ab3e9016ca3e38cc99819f4a03653e387
SSDEEP 96:FmDxPWZ6/vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:wdPNzb++uVmN
TLSH
T116D198185AF54311E2B3AB3129F54557A877B812EF33CB8E0198238E6670910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-88-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-87-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-86-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-84-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-82-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-81-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-79-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-78-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-76-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-75-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-74-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-73-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-85-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-77-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-83-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-80-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-1424-0x0000000003BE0000-0x0000000003C24000-memory.dmp

Download

memory/1960-1425-0x000000002A0F0000-0x000000002A6AA000-memory.dmp

Download

memory/1960-1426-0x000000002A7B0000-0x000000002A816000-memory.dmp

Download

memory/1960-1427-0x000000002B4A0000-0x000000002B532000-memory.dmp

Download

memory/1960-1428-0x000000002B590000-0x000000002B5E0000-memory.dmp

Download

memory/1960-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/1960-1429-0x000000002C0E0000-0x000000002C0EA000-memory.dmp

Download