5d84655ea6e30ea07b44704f48cf5320c62deabba05ba6f55b40dc1eb8687e17

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 37.0MB
Sample261001-n4mpcs1fpg
SHA256 5d84655ea6e30ea07b44704f48cf5320c62deabba05ba6f55b40dc1eb8687e17
MD5 7634d70aa736529e94187fde85a49f80
SHA1 a269b51044d22c8bdae2254d4868a8f67a78c0d1
SHA512 d810883c9321baa5cbe181919419b320791b6c8033fcc1faa14682df10795aa9b397bf7eb67f5dbda114ffc65348019b886bff43cb977fa3738f2dbef245fd66
SSDEEP 786432:jx3la1iv2i4/tvMBeq5rqItX3cs7FJILMXWHZrGUI+c5MRM/U:VViC4uBjrqiVQQsXc56M/U
TLSH
T1EF8733A063FC59F9C2B67A308C16491BE77BB00507B8CA4E47A898670FA37415E7DB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe
4756	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audio system.lnk	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4584	ntrights.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5096	icacls.exe
3028	icacls.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3168	powercfg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
3400	WScript.exe
2788	WScript.exe
5000	WScript.exe
5916	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2060	cmd.exe
4576	cmd.exe
5300	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntrights.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
708	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
708	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5284	schtasks.exe
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
5976	WMIC.exe
5976	WMIC.exe
5976	WMIC.exe
5976	WMIC.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
4876	tskill.exe
4876	tskill.exe
4264	tskill.exe
4264	tskill.exe
700	tskill.exe
700	tskill.exe
4164	tskill.exe
4164	tskill.exe
2612	tskill.exe
2612	tskill.exe
1092	tskill.exe
1092	tskill.exe
4544	tskill.exe
4544	tskill.exe
2916	tskill.exe
2916	tskill.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3168	powercfg.exe
Token: SeCreatePagefilePrivilege	3168	powercfg.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeIncreaseQuotaPrivilege	4844	powershell.exe
Token: SeSecurityPrivilege	4844	powershell.exe
Token: SeTakeOwnershipPrivilege	4844	powershell.exe
Token: SeLoadDriverPrivilege	4844	powershell.exe
Token: SeSystemProfilePrivilege	4844	powershell.exe
Token: SeSystemtimePrivilege	4844	powershell.exe
Token: SeProfSingleProcessPrivilege	4844	powershell.exe
Token: SeIncBasePriorityPrivilege	4844	powershell.exe
Token: SeCreatePagefilePrivilege	4844	powershell.exe
Token: SeBackupPrivilege	4844	powershell.exe
Token: SeRestorePrivilege	4844	powershell.exe
Token: SeShutdownPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeSystemEnvironmentPrivilege	4844	powershell.exe
Token: SeRemoteShutdownPrivilege	4844	powershell.exe
Token: SeUndockPrivilege	4844	powershell.exe
Token: SeManageVolumePrivilege	4844	powershell.exe
Token: 33	4844	powershell.exe
Token: 34	4844	powershell.exe
Token: 35	4844	powershell.exe
Token: 36	4844	powershell.exe
Token: SeIncreaseQuotaPrivilege	5976	WMIC.exe
Token: SeSecurityPrivilege	5976	WMIC.exe
Token: SeTakeOwnershipPrivilege	5976	WMIC.exe
Token: SeLoadDriverPrivilege	5976	WMIC.exe
Token: SeSystemProfilePrivilege	5976	WMIC.exe
Token: SeSystemtimePrivilege	5976	WMIC.exe
Token: SeProfSingleProcessPrivilege	5976	WMIC.exe
Token: SeIncBasePriorityPrivilege	5976	WMIC.exe
Token: SeCreatePagefilePrivilege	5976	WMIC.exe
Token: SeBackupPrivilege	5976	WMIC.exe
Token: SeRestorePrivilege	5976	WMIC.exe
Token: SeShutdownPrivilege	5976	WMIC.exe
Token: SeDebugPrivilege	5976	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5976	WMIC.exe
Token: SeRemoteShutdownPrivilege	5976	WMIC.exe
Token: SeUndockPrivilege	5976	WMIC.exe
Token: SeManageVolumePrivilege	5976	WMIC.exe
Token: 33	5976	WMIC.exe
Token: 34	5976	WMIC.exe
Token: 35	5976	WMIC.exe
Token: 36	5976	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5976	WMIC.exe
Token: SeSecurityPrivilege	5976	WMIC.exe
Token: SeTakeOwnershipPrivilege	5976	WMIC.exe
Token: SeLoadDriverPrivilege	5976	WMIC.exe
Token: SeSystemProfilePrivilege	5976	WMIC.exe
Token: SeSystemtimePrivilege	5976	WMIC.exe
Token: SeProfSingleProcessPrivilege	5976	WMIC.exe
Token: SeIncBasePriorityPrivilege	5976	WMIC.exe
Token: SeCreatePagefilePrivilege	5976	WMIC.exe
Token: SeBackupPrivilege	5976	WMIC.exe
Token: SeRestorePrivilege	5976	WMIC.exe
Token: SeShutdownPrivilege	5976	WMIC.exe
Token: SeDebugPrivilege	5976	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5976	WMIC.exe
Token: SeRemoteShutdownPrivilege	5976	WMIC.exe
Token: SeUndockPrivilege	5976	WMIC.exe
Token: SeManageVolumePrivilege	5976	WMIC.exe
Token: 33	5976	WMIC.exe
Token: 34	5976	WMIC.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3400	1664	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 1664 wrote to memory of 2788	1664	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 3400 wrote to memory of 2060	3400	WScript.exe	90
PID 2060 wrote to memory of 4584	2060	cmd.exe	92
PID 2060 wrote to memory of 3168	2060	cmd.exe	93
PID 2060 wrote to memory of 5284	2060	cmd.exe	94
PID 2060 wrote to memory of 4844	2060	cmd.exe	98
PID 5916 wrote to memory of 4576	5916	WScript.exe	101
PID 2060 wrote to memory of 5652	2060	cmd.exe	104
PID 2060 wrote to memory of 4488	2060	cmd.exe	105
PID 2060 wrote to memory of 5096	2060	cmd.exe	106
PID 2060 wrote to memory of 3028	2060	cmd.exe	107
PID 2060 wrote to memory of 5300	2060	cmd.exe	108
PID 5300 wrote to memory of 5976	5300	cmd.exe	109
PID 5300 wrote to memory of 5884	5300	cmd.exe	110
PID 2060 wrote to memory of 4756	2060	cmd.exe	112
PID 2060 wrote to memory of 1080	2060	cmd.exe	113
PID 2060 wrote to memory of 4876	2060	cmd.exe	114
PID 2060 wrote to memory of 4264	2060	cmd.exe	115
PID 2060 wrote to memory of 700	2060	cmd.exe	116
PID 2060 wrote to memory of 4164	2060	cmd.exe	117
PID 2060 wrote to memory of 2612	2060	cmd.exe	118
PID 2060 wrote to memory of 1092	2060	cmd.exe	120
PID 2060 wrote to memory of 4544	2060	cmd.exe	121
PID 2060 wrote to memory of 2916	2060	cmd.exe	122
PID 2060 wrote to memory of 708	2060	cmd.exe	123
PID 2060 wrote to memory of 4620	2060	cmd.exe	125
PID 2060 wrote to memory of 1676	2060	cmd.exe	126
PID 2060 wrote to memory of 2280	2060	cmd.exe	127
PID 2060 wrote to memory of 712	2060	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5652	attrib.exe
4488	attrib.exe
4620	attrib.exe
1676	attrib.exe
2280	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Security\unistall.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k unistall.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Security\ntrights.exe
      ntrights -u Admin +r SeLockMemoryPrivilege
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4584
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:3168
  - - C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "repair network services" /sc onstart /delay 0000:50 /RL HIGHEST /RU system /tr "C:\updat\downtrj.vbs" /NP /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Security,C:\Users\Admin\AppData\Roaming,C:\updat,C:\Netframework.4.7"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4844
  - - C:\Windows\system32\attrib.exe
      attrib +H system.bat
      4⤵
      Views/modifies file attributes
      PID:5652
  - - C:\Windows\system32\attrib.exe
      attrib +H system.vbs
      4⤵
      Views/modifies file attributes
      PID:4488
  - - C:\Windows\system32\icacls.exe
      icacls C:\Security\system.bat /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:5096
  - - C:\Windows\system32\icacls.exe
      icacls C:\Security\system.bat /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:3028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic path win32_useraccount where name='Admin' get sid /value | find /i "SID"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5300
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_useraccount where name='Admin' get sid /value
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5976
    - - C:\Windows\system32\find.exe
        
        find /i "SID"
        5⤵
        
        PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(gc C:\Security\system.xml) -replace '22', 'S-1-5-21-461973139-3212354679-1508698038-1000 ' | Out-File -encoding ASCII C:\Security\system.xml"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4756
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "audio system" /XML "C:\Security\system.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1080
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4876
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4264
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:700
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4164
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2612
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1092
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4544
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2916
  - - C:\Windows\system32\PING.EXE
      ping -n 50 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:708
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Netframework.4.7\audio.exe
      4⤵
      Views/modifies file attributes
      PID:4620
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Netframework.4.7
      4⤵
      Views/modifies file attributes
      PID:1676
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Security
      4⤵
      Views/modifies file attributes
      PID:2280
  - - C:\Windows\system32\cmd.exe
      cmd /c del "C:\Security\unistall.bat"
      4⤵
      PID:712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Security\audio.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  PID:2788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\updat\downtrj.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:5000

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Security\system.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k system.bat
  2⤵
  - Executes a command shell one-liner
  PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7za.dll

Path C:\Security\7za.dll
Size 263KB
SHA256 bd377ba96ff8d3cbaea98190c8a60f32dc9d64dd44eed9aade05d3a74d935701
MD5 3107caecf7ec7a7ce12d05f9c3ab078f
SHA1 b72ac571efde591906771b45bed5b7dc568d7b08
SHA512 e5f7bceb39975bc77de3d118ab17aed0f2bd5df12dbbcad5a355c34d71dff883a482b377e4b98622ccc3ba48649ba3330d3bb0bac7f9f2e861d9af0c10d1637e
SSDEEP 6144:ZNnwY0ozR5spzvSrnHefQOWdFQJvUhq36F:ZGY0YR5VrnHefgd6JvUe6F
TLSH
T12F449E2177FAC0F5C9872230961DBBBA95FAA3491B10C8C36380DE5A6E375E6D23D50D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Security\7za.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zxa.dll

Path C:\Security\7zxa.dll
Size 155KB
SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
MD5 786d4c74c05832a652be5c0a559be1e6
SHA1 56bc5cf0bef56565da871af9e10ac8c2302d2ad7
SHA512 29cf07d3acceb716a2e9ec66434170ba7f15c5af3c843253d72be6f7bf1ab942a6e098a423beb33efb9fbf8bb6c967c34d4dedf65aca72984c6aa70c58e0eeb4
SSDEEP 3072:QwBYN3i204AHpzTjaLd4+OTpLcl28hpQplf4btKL6mCF:E3cp3jaLupLc3fclAKmJ
TLSH
T100F3AE2177BA80F9D24B32359A1D7FBA12BDE3484F1485C76700EE5A2E319D5E23D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Audio system.bat

Path C:\Security\Audio system.bat
Size 757B
SHA256 016a66afda31fcf7adf1a4b83f66e514fd204b14294fe1d8f0d0094a90484da7
MD5 70c0f67a93d3e8fe6a6bb390661920e2
SHA1 c26a1bfc9621f23ea9bbaf4abe690d8016bb3fc4
SHA512 0a6597059794d9fd64782d7691031639cf8bac186ed529747a7948d14298915a617d97e1c4506aab88f262dca31af72c4c8bec7c69810edb9247027a48a689f4
TLSH
T17A01650D9881BC238DFB236571F1120D77B0E640565E83D5310BC7C7D7C7A357112691
MD5 SHA1 SHA512 TLSH

Submit Download

Audio system.vbs

Path C:\Security\Audio system.vbs
Size 144B
SHA256 77db2c4dacd8c4c488187a3c875b14c2ac08e2face54cba96d9b55ae5ff84949
MD5 4d9c46f92d8c7007e77c7005fb3367be
SHA1 25dc4f4fc5df855e756ad74b725fba823fa715e5
SHA512 440dcb95298a8f4946d6d9b03858bd39e894054d5731af8ec8be51e7fd32cb4425a51d6a6c8bba9445d2b6c79e830c800fa78a1faa8d2be4b2135be48d8b72ff
TLSH
T1C6C09B1D9D3CD655D9ADC3E177F05119D79CEB535037EC28165554C543209501321773
MD5 SHA1 SHA512 TLSH

Submit Download

WinIo64.sys

Path C:\Security\WinIo64.sys
Size 15KB
SHA256 7fa19d4b2b160ca3f2decde3d7c7d867527c96f3511a9dbecc898cfc14614638
MD5 97373d38bdd890a2f1224c7d1586db91
SHA1 013651321c499fa331b0c62b2a981027c5dd112b
SHA512 dd9e1d6092ae9297541ac92330f162b8a18dfabda7a616e3305403366827da2b496a8c5fcc2cca46d24ace2aa9a46e9afd674ea9b6da457d055dd4fdae29231f
SSDEEP 384:IX4Pi8McCo0HOk8JHZV+2s8j+JiRXZfdUb+3nAK:KUC7eHZV+PC+qQi3nAK
TLSH
T10D623B9A4E2F9486DB03DE7D90C98663FC70F5C26BAC15E79126C4256D067E07FBC208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRing0x64.sys

Path C:\Security\WinRing0x64.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audio.vbs

Path C:\Security\audio.vbs
Size 1KB
SHA256 701e815a8a6f2c45e773ecfddbfb74570e6c55a3a6b8945a69206bf6cfd33d5b
MD5 1a4135b2b582f6ec8f5dec0f858420ce
SHA1 ae83505ce5024a650b553ef5fba402526c67704c
SHA512 ff6d384bafedc6acd938cfc1c11d1ee317d61f6968b2886d072b232afc29255e198723247c7819c8459b8fbcd8318d9bf2f5b45e74c3d8b4e5c0104f8451e043
TLSH
T17E219BC9E8289090599316D150F6DC08C3E2AB902823D824776FCE4D776066C0F799AA
MD5 SHA1 SHA512 TLSH

Submit Download

downtrj.bat

Path C:\Security\downtrj.bat
Size 129B
SHA256 9a0b954917610e19011081a0da7c85f959067bd58051888db9189290fa05864a
MD5 7b62c20559056bcc528571404dac4f8a
SHA1 b31ed3b96ef0332f5e8967e2a169a6b44665a79a
SHA512 9840b8a5487902fa1e488b82d2cd7c5333d9056a17b1e19ab54954a00fb88525d21a0955447a66d696338fe9615be677bfd52331a0d742b160c1e487220e65db
TLSH
T1DAB092614983D5A698701DE8B91A5016A95E009D11908CC0A6C40361680A5DC9D87D7C
MD5 SHA1 SHA512 TLSH

Submit Download

downtrj.vbs

Path C:\Security\downtrj.vbs
Size 1KB
SHA256 2bbb9daba9bd31596e3c935f9382d54912f75b5510096962ffe942bfe8b7aa77
MD5 1cf7366cf75d563fc2bcbb5f2743799f
SHA1 e740fdfda7fb7390418048a3babc43c99bacee97
SHA512 169d1a65cac930dc58c220129f18a4435ca31b9e02fa24631b47a1e20151d2e944cd8cae71fc8d7da6a80cddef6db1e97e8ae1bc6f9269daffa5330ad3104546
TLSH
T1FA217F1353FA4104F5F22794AD3609750B37BE66B479C64D06C8191E2BF3B4494A1BA7
MD5 SHA1 SHA512 TLSH

Submit Download

gtservices.exe

Path C:\Security\gtservices.exe
Size 36.1MB
SHA256 d945860b6e61d37baa3acfb8e329a8af957cb694f3680f4ae16afc85d00e9790
MD5 1cfd2ea4e13409e77ba90e480960bb75
SHA1 e5896bb610b0adfd8c0b91fddf802c9b94b35cc1
SHA512 163f208bd193a3439006fc40c2b1f88b5dcda6beddd6019912585b98030b5a8e78a1f4078a36f615cac4d3c7c42f655a9bb1ae0d7827c73749247eaed78ab9b5
SSDEEP 786432:zHf94O156lz3uA06ekXSLPLBc07xDmta+RFxBjJM:zHl156lNeVzigD4X9jJ
TLSH
T17E8733BD10F2D323D00B2DF6350E8A8908AE352F92DADE50635564BCBE632BCF55664D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mouse.bat

Path C:\Security\mouse.bat
Size 15KB
SHA256 e7def58a604a5941fec7006b4b926e761ec2dd06d04386a17a6814193b5db3d4
MD5 b419188db097f8b8ea8ad5f70c6f84d2
SHA1 dc2a3e3be04488a101816f30cd6a6ed3d50a4ef5
SHA512 7114e3245f63d7e915117e95fa08b8c711af2ad05d11c70ee64c625fc3c7f95b0581611ca7320695987a89ece45360fe9cc1e385aad58f63e4cbed5df6117d44
SSDEEP 384:f4NGxujgMItZWx3fxdkpWeF56o96dZmHb4yEx66eA3qR:f41jYtTpnH6o96dZm74yEI5
TLSH
T16A62102C094A922749B3736DBFDA449BFA3B453327E66B5174BD02605F364290360FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrights.exe

Path C:\Security\ntrights.exe
Size 31KB
SHA256 f46baa1b6227226518e42263e9b4808f81c27d060207df160f9ac64deae4f4f5
MD5 416c43aeb17252ee33048bd1f277d2a5
SHA1 085deb77551f9f6201e5aa352b62cad91c3005e5
SHA512 3155de3fb04f1df246d6cecfa1c89f8ae9963c18be1ce717731ff210ab39d537be01231002a54d4346b4116e3505f387c92dfecc18a80ce7eb99c6d33e5f1f2a
SSDEEP 384:V2xoEQ1hlwZ1GADuwSoDFJqawj0zIjiOURFtk+bn7c/bAxi1I2Y8AVq65zHwP9TG:+l6pGXtk+D7c/N1I2Cq65z60sl
TLSH
T1A5E27C11B0E5817FF0D356B456B707255B77B85003B26B8F0B9814ABAB726C0AB3B353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.bat

Path C:\Security\system.bat
Size 972B
SHA256 34ba5f9a6c0a15e3a20686869f79d5398bbcd8dcf5cd6dfe584578b37471bafe
MD5 0821ae42c1cdaa32aa63de00c7df25cc
SHA1 c5472a540b90b04654cb2aab60bdff7266cb859a
SHA512 a5a8124fb0a0cf496985ca1c02eb28a184bf8ecb2b6e900cf4441f3157d6b5bb2de73419c506ce1be6232e689cde4f55bf0d0ef7d1f1b05cd903e8ebbf52a169
TLSH
T1C111885DCD42E9378E770E55274563095FB4C483817F561930F507A6D707968A1728C5
MD5 SHA1 SHA512 TLSH

Submit Download

system.vbs

Path C:\Security\system.vbs
Size 75B
SHA256 f1693021ac9058a21c7c2836f38aa4c3e35c34cacb61ecbe6844ea46d3222a08
MD5 41e008fa98c4431c4cebea068fc38d05
SHA1 a426198b57ba7ef10094d67d348e7f744b3e0a75
SHA512 f8f1c3ec43660805d891f37b7c67608e3a6c156375641e46a3bab3b71aef84a157ec82b334ecddfd22345a6ddc8ee8f3b07bfcf16dd5baa7eec9d26d6a33d06f
TLSH
T1B9A0223A220CC88B0C0320EAA0B280088AB0FF022232AC2208C8CCC8E3208C08B320C3
MD5 SHA1 SHA512 TLSH

Submit Download

system.xml

Path C:\Security\system.xml
Size 1KB
SHA256 d090327d48e5d2d9e7ea2a1ae241c8df68a0e356769abcf019056c394783cfdd
MD5 bc0afaf911a2b931a6412825c28989a4
SHA1 22fed379e8388ec415e9374fea6d2afface4c5ba
SHA512 e5c088ee1de134fd555ba39132b6b05386f6cb4b590fed906c8ab9f9ce57f05e2907dfbde19bd6d62ccc7f89a47323e9f665c79896144fe9d4845e0ac24f07ac
TLSH
T12C310068ACC0B71B76724529A7025B82DF6687E306534138F8CC4BBB2FB5145615397B
MD5 SHA1 SHA512 TLSH

Submit Download

system.xml

Path C:\Security\system.xml
Size 1KB
SHA256 7517b69e90aab540e9536d279f6b3eba104b65c9edc8d4fb011d4376ec96b5e4
MD5 b2bbef4ef72ede3f4b998473f53f9554
SHA1 35c2f2fab43955ca668dc3d953b24e714fcb1f80
SHA512 cd3e18e6c6678f971c0361af5b629810fd30a7f75c4502bb866721f5c9e02a981fb215f74251ce57c6900c83b10b0ac14eee0d4684d24074e0913c1362fc14a7
TLSH
T163311164ACC0B31B7672453AA7025782DF6B93E346534038F4CC4BBB2FB55456193577
MD5 SHA1 SHA512 TLSH

Submit Download

unistall.bat

Path C:\Security\unistall.bat
Size 2KB
SHA256 b493e5c4630261ff199bdf4848648e6a8d45b22a6afa10034d74a603e95d22d6
MD5 7b76e3c707764d45bcdb5abc9d7ca376
SHA1 6e1aafeb548b8ec04ea2655fc5ce6006e59e195b
SHA512 3ff16be48219fac0b2cbf6d6b200e2a106b25967bd4715bdf53e825fb53d7556489409f0ac576d9056f92e2449db353b2aaf3c8e8288fb0c35daf83135ee368a
TLSH
T15B41DF1A0ECF64A68EB01FC426A3461FAF5EAF85D4521D447BD700A9F8429CCE251F7A
MD5 SHA1 SHA512 TLSH

Submit Download

unistall.vbs

Path C:\Security\unistall.vbs
Size 79B
SHA256 ffd8e49aebf15ac2ead62900000d22e7f4289d9a665204553aec17ec1b14fbe0
MD5 d7190306fcb959c473b8639196861980
SHA1 cb4a7f4910eefb8a9b529b2b5ccff93ab4b05aed
SHA512 acb3f43bea77a1ca3cd278ca88a3fdb6b290572c8bf4fe06660c0ddeefd388bb67e7c1b8fe1dcee824ff838dcdbae54e50f86439a7d1af84b325ff7dd3458747
TLSH
T1AEA02435F00CC4734CC713D14031410C44F0FD01113074504D40CCCC73144C04315043
MD5 SHA1 SHA512 TLSH

Submit Download

wget.vbs

Path C:\Security\wget.vbs
Size 2KB
SHA256 abd498d8a265116de034a8cbc7c2fc40a312dfe5b2c4161bd46cbaa93d187ed2
MD5 35e0cf9358aecb9039b0e6849627dcd1
SHA1 a96667d05a46cf85fb26fb07a4943f17359440ac
SHA512 3b07e52ba577792b9497d19c38a0f967f80ab65287559f0a6cf2ba1f37ef60aa98d0609459b7635364131cdd91ace0e5ac236044279118e2e0c5b46c580d8b46
TLSH
T1E351945323F89104B1F77E559AB669754737BFB5A8B9C70E00C40A0D1AE1E508CA5BF3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f3z1vqx2.qbc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f3z1vqx2.qbc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4844-74-0x000001E4D1230000-0x000001E4D123A000-memory.dmp

Download

memory/4844-73-0x000001E4D1450000-0x000001E4D1502000-memory.dmp

Download

memory/4844-72-0x000001E4D1210000-0x000001E4D122E000-memory.dmp

Download

memory/4844-67-0x000001E4D1160000-0x000001E4D1182000-memory.dmp

Download