d43e918d3ca2313f5b97b18c54434632ff54b6094e0c1d62af646324d11b956a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 4.7MB
Sample261001-zzghbsbe33
SHA256 d43e918d3ca2313f5b97b18c54434632ff54b6094e0c1d62af646324d11b956a
MD5 f602056ca1cc40f0cbe0a2bcf5b78048
SHA1 ee3aca277431505ae20969ab0ad131d82e685daf
SHA512 06ae05e52c2e8ce7e3b66a53beb8f38e737ceb045e18ad3b57d1fdf4e64f643de2a8c7b595c9f7daa69d0ef73fdb72ec9e5bd7b5b13a4f413a85b75651fdd233
SSDEEP 98304:EKAawqhrMM3mUJqmZvvkyEjKXXl6+SHH23Q4wjo2Yfi7VzT:EGYQm2MyzHMkQ4wjnYfYT
TLSH
T142362359D7B400FDF1A6A1B4DD934817E77A788D07F1E68F03A19DE21F232905A3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C:\Program Files\Microsoft OneDrive\OneDrive\Microsoft OneDrive.lnk	2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 6 IoCs

pid	Process
4688	sslconf.exe
3676	sslconf.exe
6052	sslconf.exe
3448	sslconf.exe
5668	brightdossierpocket.exe
3836	P1VsPdpIYe.exe

Loads dropped DLL 8 IoCs

pid	Process
4688	sslconf.exe
4688	sslconf.exe
3676	sslconf.exe
3676	sslconf.exe
6052	sslconf.exe
6052	sslconf.exe
3448	sslconf.exe
3448	sslconf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoldenRodPaleVioletRed = "\"C:\\Windows\\System32\\cmd.exe\" /c cd /d \"C:\\ProgramData\\PaleGreenWhiteSmoke\" && \"C:\\Windows\\System32\\wscript.exe\" \"C:\\ProgramData\\PaleGreenWhiteSmoke\\GoldenRodPaleVioletRed.js\" //B //Nologo"	sslconf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3836	P1VsPdpIYe.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c44b-21.dat	upx
behavioral2/memory/4688-25-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/4688-27-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/3676-31-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/6052-34-0x00007FFEAF020000-0x00007FFEAF353000-memory.dmp	upx
behavioral2/memory/3676-38-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/6052-40-0x00007FFEAF020000-0x00007FFEAF353000-memory.dmp	upx
behavioral2/memory/3448-48-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/3676-54-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/3676-124-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/3448-126-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx
behavioral2/memory/3448-146-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3364	cmd.exe
5208	cmd.exe
5716	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5024	5668	WerFault.exe	99

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	P1VsPdpIYe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	P1VsPdpIYe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sslconf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	brightdossierpocket.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\C:\Program Files\Microsoft OneDrive\Microsoft OneDrive.lnk	2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
4688	sslconf.exe
3676	sslconf.exe
3676	sslconf.exe
6052	sslconf.exe
6052	sslconf.exe
3676	sslconf.exe
3676	sslconf.exe
6052	sslconf.exe
6052	sslconf.exe
6052	sslconf.exe
3676	sslconf.exe
6052	sslconf.exe
3676	sslconf.exe
6052	sslconf.exe
3676	sslconf.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
5668	brightdossierpocket.exe
808	Process not Found
5668	brightdossierpocket.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe
Token: SeDebugPrivilege	4688	sslconf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4688	1288	2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 4688 wrote to memory of 3676	4688	sslconf.exe	91
PID 1288 wrote to memory of 6052	1288	2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe	93
PID 6052 wrote to memory of 3448	6052	sslconf.exe	95
PID 3676 wrote to memory of 3364	3676	sslconf.exe	96
PID 1288 wrote to memory of 5668	1288	2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe	99
PID 3364 wrote to memory of 3836	3364	cmd.exe	101
PID 1288 wrote to memory of 5716	1288	2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe	108
PID 5716 wrote to memory of 4612	5716	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_f602056ca1cc40f0cbe0a2bcf5b78048_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Creates a file in the Startup directory
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe
    "C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c start "" C:\Users\Admin\P1VsPdpIYe.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Users\Admin\P1VsPdpIYe.exe
        
        C:\Users\Admin\P1VsPdpIYe.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Reads the TCP/IP host and domain name from the registry
        
        PID:3836
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe
    "C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    PID:3448
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\brightdossierpocket.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\brightdossierpocket.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 596
    3⤵
    - Program crash
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\system32\wscript.exe
    wscript //nologo //B //E:JScript "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.bat"
    3⤵
    PID:4612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd /d "C:\ProgramData\PaleGreenWhiteSmoke"
1⤵
- Executes a command shell one-liner
PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5668 -ip 5668
1⤵
PID:2716

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\ProgramData\PaleGreenWhiteSmoke\GoldenRodPaleVioletRed.js" //B //Nologo
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoldenRodPaleVioletRed.js

Path C:\ProgramData\PaleGreenWhiteSmoke\GoldenRodPaleVioletRed.js
Size 70B
SHA256 a9ff5d2faeb2316bf5b57a2a7abf65b1cf17bc48f8009558016426c91dd6893a
MD5 d6c662b8b605e325c2ef0a80d0de6119
SHA1 2f592d5d35b6fa8a1ba6b2e63c348a4e69e9a660
SHA512 923692a14346f755561649c4d113fb266fef2603365c5b77f1fd224d0d9630cfeb1ec48b36294f5e0b9e6bc8dff070b07d2181e7bbc09e7a3322c90c88164909
TLSH
T19DA0220028BCF88C8283C3FA0000E30A0AC38CC23002B8280000CBECFB28000028888B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

5991A405E33BCD195816753A1A2029D6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5991A405E33BCD195816753A1A2029D6
Size 56KB
SHA256 2971642a1f3b08365375626565515843aeb1a48ab0b1d6b88b9e741f5e86b8e6
MD5 ce89ded225366d685660daa4deee04d6
SHA1 bd30736538cfc52a49c355d7ecb4b96c23dc053c
SHA512 c033758d35415416ae46198fad3c5bf4b944b6d909b0cc37c49ae076a565d6d9ca29a8f895db2f0f85dcb80d153ef0cdfe816d17dffdc1b107564cd692927565
SSDEEP 768:cKwmuOFt8HJoXT2DRR+bv5RoeeiqFnRvKeF1Pe4kt1o0+qeEJ5/esZb1gLPYegn2:vH8WXKDRR+1ei0RvJ163eqfM4vm
TLSH
T109431A686DBBB1A25E4BDE618CDA8E93D6F461DD21127F2B4E316E405D03A8FCE570C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 7f0db916f1d4bbc293eb8e9a56e1242592d37268460c05123b0f4e4511d40a5f
MD5 7d5f1ed93560878f8addb1d6bf229350
SHA1 8b19b0e4f34788a68c6a4a67bf73806af78dd231
SHA512 beda929b9e6399467a0c158f4d544fabc852e6b74873d928edad654c46ee2f50b3fe560a449f9986e0f9ca7bb9b85a9c1c4fbd95ce033ebe4073532e9ba7d491
TLSH
T10DC0801C19510615F194437C01C13D5397105101E2418F0516F12544C957B152834C29
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 4c2ed80521908c1db8ac5d1ffab17a29d78bf267a86e301623b1e3922ccba66b
MD5 20423cf72f589ab58eaf0d3b84aa7b9e
SHA1 544df7df2ba255175431e829e2074bcd0f1025ca
SHA512 df64534e68444839870056a4bce71d4bf8f4d366f9e10827c0108d64be8cd42dcb10f803a20319a958d5ddc0af08da6c6118bda250754a4d0ad9a3b2d45ed8d4
TLSH
T127C08C1C4A660726F2E4437D12D13E43AF608821F6458F0116F16A48CC11F542CB5C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 723cb146fcd3e6a493bb92d90050c7924122aaca73990a43fb2272a4d8dcdb6d
MD5 72d12349330f30d6a95032daafbae995
SHA1 a5cf8e544154f96d5dec1a1320d6a128646f1d98
SHA512 8436eeaf4fb1ba287c2eda613bbef3119aaa30e90a5a85a10227929718fd87f880f0007aa29181e6ec5938771c2e6838282043c1e76c2b72f05bb38a03346672
TLSH
T19DC08C182BA20626F2E80BBE22D22A839A16D101F2818F4A167A2A888C50B181C31C1C
MD5 SHA1 SHA512 TLSH

Submit Download

5991A405E33BCD195816753A1A2029D6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5991A405E33BCD195816753A1A2029D6
Size 246B
SHA256 355987c07091c49e9179616a1158c8a71e07da748233d35e5462cf18285c0225
MD5 8964bffd9808e999ef552a7fb5738e2d
SHA1 33b97bebd5437a02330ba2d97e6046b6381ffe3e
SHA512 a4d99517b497a52cbb3cb99194754079995695b4a68f408bc11bd52cf075381d5af60b75ab2910b02cebdbd60fcb8c7506feae94c74f4b2a97e3359b2c5f26b2
TLSH
T1A7D022082BD2872EF0BA46359BB04171BA60B529B286ABAD0BE3074C8C0CF511821828
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
Size 130KB
SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
MD5 6a969b545789b0be2178d2d79ca603fc
SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
TLSH
T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brightdossierpocket.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\brightdossierpocket.exe
Size 5.3MB
SHA256 47f4470fe3d0d263ae3d07e963571f21f9a8f8d8c0ed04ba7fcc07ec3acdd485
MD5 4a460c0b5977f54abcb022d6d3aa0389
SHA1 1f690d6945181f968ed82c297b3c2a7b5f76e645
SHA512 c064626a212f882d69bc4d39f740a0a3ad3ec114e1a0bb5f87121f1e1578fa7a853ed113ef967de9d97763a7cad61d3cfa6abd796c0f093c4d7b11ae2ee1f34d
SSDEEP 24576:veRTVBcExx+QZJls3jpnz1wxKgrY1Jn03IWqx+mh0rXPUlZTft:29+QZczFWxKzhg6/STWZTV
TLSH
T18246B7CFD3009D1BFF7F94BF60B9E2F16C4093745D944E8167A0DD6A5AA4ACBE002A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.bat
Size 6.9MB
SHA256 69e8fea9e875daf8cf46d43050dc0a01c0ac889c6bf72eeb798c775138043373
MD5 57ec71e50822ad3de8e2a0bed157d28e
SHA1 51fc8731bd74bc32d84f9bb89f68bc6d86fe0b65
SHA512 e7da653b4c7b4f25e8bedfbd2193829cf20e34b75047cc3c3fb0cf6eeb81b85f8792f73d87185ce9b362147266bb349571d0f78b08f002cdaf024a99d895a6da
SSDEEP 6144:jnIQWD6ck9L+sHj1i5g7jN/J47VzSlXl/mAovCRfhH/H9ombl76zE/fhXC34ff4K:erpZGOK
TLSH
T1837632B6A2EC22254457C297FC3AAA8DCB399054516DB37A6CFF91CCD58CADC523F900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sslconf.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe
Size 29KB
SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
MD5 71fdd6fb7f0acd3e9a6206851452e11b
SHA1 82011a9ff3692236df69427eb200ba05799205b0
SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
TLSH
T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempdir.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\tempdir.dll
Size 8.4MB
SHA256 52bc70e68e89f939193d9456f6066aa03d95b3763fba34b48d28de05dc20b5ad
MD5 954fdc79a8b1ab0fb53ada1fd454cb01
SHA1 14cf73d2b52c18409b35d4514b1a3c1556e4cdb2
SHA512 a5cabd8040ab59f024580a5482d346e15c09d27605beba48dce641b8557ba98f06933aa83dfd536736d01c4ecb70b0c1ca92af4ad52eb90c2ecc126ff30fdbb5
SSDEEP 49152:kTcoiEb+S1Tkq4Ju4KMf2VETGfiy1TPGcJ0A4UPtLNXM48eTc:voKS1YPf2STGfiMPniAVd/
TLSH
T1CB9633BCB1D0BFACF257ECF210151E1D3A231F23A4BA1E0183709A6B6B942B55F97495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P1VsPdpIYe.exe

Path C:\Users\Admin\P1VsPdpIYe.exe
Size 1.8MB
SHA256 61e4e1318add3ab4d3982bf5f8e4ad85dacc20a18910adbb5b18f50aaf592a24
MD5 0e820b51d307d2486628eca97cc3ddc1
SHA1 aeb23778a7fb27e862f78fa3007014e1cd6a6504
SHA512 be263c7f0eaf69519665b7aad70832ff34c4d885c2cb3ecb677d739063c97ca2de6d7ee29061ba74986750a86f0beae2f70892d30b4cab64725cd310eb208333
SSDEEP 24576:hu8FH3n8l6apyg2bW11V7XtkVj/MskCoBEQafdNSAnfn/p1:hNn8ggcbWDKIsJUZa1NSAnff
TLSH
T1E685CF17BBE18891EC62CE3695B2E30BD328FC948778D78771582F82BE624C14D5B785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-137-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-126-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3448-143-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-145-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-139-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-138-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-136-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-140-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-144-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-142-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-48-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3448-141-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-134-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-135-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-133-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3448-146-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3676-105-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-104-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-113-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-112-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-110-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-106-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-109-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-108-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-107-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-111-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-114-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-97-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-31-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3676-38-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3676-54-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3676-124-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/3676-103-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3676-115-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3836-76-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-81-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-77-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-80-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-82-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-83-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-84-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-78-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-79-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-73-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-61-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-75-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-72-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/3836-74-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/4688-27-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/4688-25-0x00007FFEAF360000-0x00007FFEAF693000-memory.dmp

Download

memory/6052-34-0x00007FFEAF020000-0x00007FFEAF353000-memory.dmp

Download

memory/6052-40-0x00007FFEAF020000-0x00007FFEAF353000-memory.dmp

Download