b3cff9bf1f9e94845188e2d6e8094d02f16686fbd0cf0c1866d9cb1f8cc4cb9c

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 8.1MB
Sample261002-vrp3aatvex
SHA256 b3cff9bf1f9e94845188e2d6e8094d02f16686fbd0cf0c1866d9cb1f8cc4cb9c
MD5 312843767e253d1ba118db39620765b2
SHA1 6b8b0a6308d8d8c3ef492355db6494397a34d989
SHA512 ebf0ca4b0aaabac448422ecb46079a3a738dfd1974de64c94ede8e6de00ca9020477e2baad712293485a4d36021264aae85b0b2d567115c171b12a72f1ed36ed
SSDEEP 196608:EO7mfndVRB8mM9YydALnaDQU4uKAcs1hZUUvf/vsam6DH03Xo:pod18lY0KAXHpvfMpmH0no
TLSH
T1AD86339DDBA006FDE1A7D278CE834807F775B84803B1E69F13A45DE65F232905A3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C:\Program Files\OneDrive\Microsoft OneDrive.lnk	2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 7 IoCs

pid	Process
5052	sslconf.exe
2500	sslconf.exe
1448	calminbox3.exe
252	msteams.exe
4212	sslconf.exe
1520	P1VsPdpIYe.exe
2912	sslconf.exe

Loads dropped DLL 8 IoCs

pid	Process
5052	sslconf.exe
5052	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
4212	sslconf.exe
4212	sslconf.exe
2912	sslconf.exe
2912	sslconf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoldenRodPaleVioletRed = "\"C:\\Windows\\System32\\cmd.exe\" /c cd /d \"C:\\ProgramData\\PaleGreenWhiteSmoke\" && \"C:\\Windows\\System32\\wscript.exe\" \"C:\\ProgramData\\PaleGreenWhiteSmoke\\GoldenRodPaleVioletRed.js\" //B //Nologo"	sslconf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1520	P1VsPdpIYe.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4d0-21.dat	upx
behavioral2/memory/5052-25-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/5052-26-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/5052-28-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/2500-37-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/4212-46-0x00007FFC6D180000-0x00007FFC6D4B3000-memory.dmp	upx
behavioral2/memory/2500-64-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/2500-65-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/4212-100-0x00007FFC6D180000-0x00007FFC6D4B3000-memory.dmp	upx
behavioral2/memory/2912-103-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/2912-126-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx
behavioral2/memory/2500-128-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5188	cmd.exe
3484	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	P1VsPdpIYe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msteams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	P1VsPdpIYe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msteams.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	sslconf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	sslconf.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sslconf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sslconf.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\C:\Program Files\OneDrive\Microsoft OneDrive.lnk	2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
5052	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
2500	sslconf.exe
1448	calminbox3.exe
1448	calminbox3.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
1448	calminbox3.exe
828	Process not Found
1448	calminbox3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe
Token: SeDebugPrivilege	5052	sslconf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5052	4704	2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 5052 wrote to memory of 2500	5052	sslconf.exe	91
PID 4704 wrote to memory of 1448	4704	2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe	93
PID 1448 wrote to memory of 252	1448	calminbox3.exe	94
PID 4704 wrote to memory of 4212	4704	2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe	95
PID 2500 wrote to memory of 3484	2500	sslconf.exe	99
PID 3484 wrote to memory of 1520	3484	cmd.exe	101
PID 4212 wrote to memory of 2912	4212	sslconf.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_312843767e253d1ba118db39620765b2_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Creates a file in the Startup directory
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe
    "C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c start "" C:\Users\Admin\P1VsPdpIYe.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\Users\Admin\P1VsPdpIYe.exe
        
        C:\Users\Admin\P1VsPdpIYe.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Reads the TCP/IP host and domain name from the registry
        
        PID:1520
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\calminbox3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\calminbox3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\msteams.exe
    "C:\Users\Admin\AppData\Local\Temp\msteams.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:252
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe
    "C:\ProgramData\PaleGreenWhiteSmoke\sslconf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    PID:2912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd /d "C:\ProgramData\PaleGreenWhiteSmoke"
1⤵
- Executes a command shell one-liner
PID:5188

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\ProgramData\PaleGreenWhiteSmoke\GoldenRodPaleVioletRed.js" //B //Nologo
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoldenRodPaleVioletRed.js

Path C:\ProgramData\PaleGreenWhiteSmoke\GoldenRodPaleVioletRed.js
Size 70B
SHA256 a9ff5d2faeb2316bf5b57a2a7abf65b1cf17bc48f8009558016426c91dd6893a
MD5 d6c662b8b605e325c2ef0a80d0de6119
SHA1 2f592d5d35b6fa8a1ba6b2e63c348a4e69e9a660
SHA512 923692a14346f755561649c4d113fb266fef2603365c5b77f1fd224d0d9630cfeb1ec48b36294f5e0b9e6bc8dff070b07d2181e7bbc09e7a3322c90c88164909
TLSH
T19DA0220028BCF88C8283C3FA0000E30A0AC38CC23002B8280000CBECFB28000028888B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

5991A405E33BCD195816753A1A2029D6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5991A405E33BCD195816753A1A2029D6
Size 56KB
SHA256 7e23f111b3c95255827b8ac1db78f170064108ca1710b624ed61074ba024364b
MD5 0c82305f63bb99435468045804d76117
SHA1 cea94c3014de3cf25033c494a91b9f5b23d3a478
SHA512 7b6eeda7b395155f9b793188fa989469045f68fb0b5283f2cf07fc4b119257e465783ef16b1ddf012e86d94bff146aca282593f3e601373c23d3a8cf873aa4e2
SSDEEP 768:hkluOFt8HJoXT2DRR+bv5RoeeiqF5RvKeF1Pe4S/1o0+weEJ5/hsZb1gLPYegcu7:KH8WXKDRR+1eiqRvJ1MjeqWMYbfZ
TLSH
T14E4319686EBBB1A25E4BDE618CDA8E93D6F461DD21127F1B4E316E505D03A8FCE530C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 378b71667dba9220a2c062e2dbc4d01a8e776a363cbde420a38a3c1a44d694bc
MD5 590a01b83e54a5e5f45a725fb0473ee0
SHA1 8977860e06088f40f4b347e32bfb56cf51caa9e9
SHA512 20e889bac75186b8497b1a5f06f2b694d30aaee73b75f3dfa66bb00d142efc3d543fb13afb1f2ebd07a1cd5208bf6b7c7d9e59e69427a9b644dc0980bcc6269a
TLSH
T13AC08C2C1AA24A16F2A843BC12C279039B208101E2418F052AF12A08D9A6B367838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 ad518dd384fde694a990d5f3d5d2146058a0ef7e48e70238830f7989e13e52c1
MD5 1fc24aaa27cb7083bdd3bee763b92946
SHA1 cc45e69a19f92902e919e0aa24a0bd288ab1cb0c
SHA512 f3f9f031c1bb1c1eeb0ef2a8585884740e17bf6bfd870ae6f5ea9eec4b2769590787adbee9db396a5f4e090ab99ab451872e08dfdefee9fbc14a9ced7c219613
TLSH
T17DC08C2C4A62470BF2E5437E02C23D039B208420F3458F0127B12A08CC22FA02C34C2D
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 58e88824f37974265747c0371409c742fd51c2342c4c20f74b4c613e54839837
MD5 b386bc4b23e456042a666db3b63097a4
SHA1 bf6615f7370a78f3921d6050e5ebbe8b32f52c0b
SHA512 c6999409b124ee1ce48b9fde6b39816648083d7a8271b42ee72aeb9b1c659fefe6d784bd52c48f5e2e0623c8d7c4285310e1a66c90aa2f79f069e2d2748e0e98
TLSH
T102C08C181BA20616F2E80BBE22D12A839A14D006F2918F0A263A2A4C8C20F645C30C2C
MD5 SHA1 SHA512 TLSH

Submit Download

5991A405E33BCD195816753A1A2029D6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5991A405E33BCD195816753A1A2029D6
Size 246B
SHA256 52e4ba5cb515f63c144d6d2fed14987f2f69572c1a820f35f71233307258f0aa
MD5 1e5b51c0fd8af4ddca18ce996b2fc9bd
SHA1 de925a25d3f130208f4bcdf79bed50bb1f288661
SHA512 7a8b83deb4e29fbb33ac6572bee72d02dac1b7f5103bc16128e0e1e496c28e1b87b6cf8c5ed23a08607153b0b0ac978ebf9c9dd03dcf0aed9cea0bbf8a643cae
TLSH
T1CDD02230AB200337F2848B395C9151C3EEA8A407F5825F188FB307484839B218CA1C2D
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
Size 130KB
SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
MD5 6a969b545789b0be2178d2d79ca603fc
SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
TLSH
T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

calminbox3.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\calminbox3.exe
Size 8.2MB
SHA256 da6f1475b709469e1125193acc03f4a2fa59e1bd69d1c8fcd9c8dc4b572d04bc
MD5 ea3215357b062c40e4e920791f0a95bf
SHA1 ebf9b7d1a3296b49377aa1cf331a12d575708caa
SHA512 14ba1972d93ebc9e27148112b923b97ec431f4d446a503d06e9ccb420c3650bb3b593945b63a0d40b7e643987d57f2f4185088945b4ae5c95cc0e05f18c64d98
SSDEEP 49152:5g8KQsBeQu1mvU1DDRQvUlHgxjhhhBCi857N/CpId7Q+B4d8m9JnRvDkVmA+3cUU:N0dH4+n/hkFhNKGdT4dlDtFpCDB4LS
TLSH
T1E786B62592080395F539F3BE0AD97BB97B147F28B0340419B7DE6993A513DA0E7F43A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sslconf.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sslconf.exe
Size 29KB
SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
MD5 71fdd6fb7f0acd3e9a6206851452e11b
SHA1 82011a9ff3692236df69427eb200ba05799205b0
SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
TLSH
T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempdir.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\tempdir.dll
Size 8.4MB
SHA256 52bc70e68e89f939193d9456f6066aa03d95b3763fba34b48d28de05dc20b5ad
MD5 954fdc79a8b1ab0fb53ada1fd454cb01
SHA1 14cf73d2b52c18409b35d4514b1a3c1556e4cdb2
SHA512 a5cabd8040ab59f024580a5482d346e15c09d27605beba48dce641b8557ba98f06933aa83dfd536736d01c4ecb70b0c1ca92af4ad52eb90c2ecc126ff30fdbb5
SSDEEP 49152:kTcoiEb+S1Tkq4Ju4KMf2VETGfiy1TPGcJ0A4UPtLNXM48eTc:voKS1YPf2STGfiMPniAVd/
TLSH
T1CB9633BCB1D0BFACF257ECF210151E1D3A231F23A4BA1E0183709A6B6B942B55F97495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msteams.exe

Path C:\Users\Admin\AppData\Local\Temp\msteams.exe
Size 620KB
SHA256 6f434d99b63cdf89cdb5bfa6be6d8bb313972a0709bf3c231bc5c21dd2456a08
MD5 07e4e13390dc403ff23925a179baaa85
SHA1 3a707070e97a8cb3629154b2714565d3eca6de30
SHA512 cd1423671788436c878e8c0804294e32a314e1d684a202e87c26618ab7efe860428efe0ed1580090a5bc20d447ab4e13ca6b8424314d141319bed7133e05fdf1
SSDEEP 6144:/KOEx+/9I7iIPqiSomRTcWbHiddZZSuXx2+4bPKm4+WCTNZil10lAJNxcGUv1oc1:/K+MFSoiTcWbCddgo1Tb2vGcqgA
TLSH
T198D47C16EBE402F9D17BC1B4CA829856EB77B855533065CB03E209675F3B6A05F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P1VsPdpIYe.exe

Path C:\Users\Admin\P1VsPdpIYe.exe
Size 1.8MB
SHA256 61e4e1318add3ab4d3982bf5f8e4ad85dacc20a18910adbb5b18f50aaf592a24
MD5 0e820b51d307d2486628eca97cc3ddc1
SHA1 aeb23778a7fb27e862f78fa3007014e1cd6a6504
SHA512 be263c7f0eaf69519665b7aad70832ff34c4d885c2cb3ecb677d739063c97ca2de6d7ee29061ba74986750a86f0beae2f70892d30b4cab64725cd310eb208333
SSDEEP 24576:hu8FH3n8l6apyg2bW11V7XtkVj/MskCoBEQafdNSAnfn/p1:hNn8ggcbWDKIsJUZa1NSAnff
TLSH
T1E685CF17BBE18891EC62CE3695B2E30BD328FC948778D78771582F82BE624C14D5B785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-67-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-78-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-89-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-88-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-90-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-86-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-85-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-83-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-82-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-80-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-84-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-87-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-104-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-105-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-81-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/1520-79-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/2500-120-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-119-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-128-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/2500-106-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-37-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/2500-112-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-113-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-121-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-64-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/2500-114-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-116-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-117-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-123-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-124-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-122-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-65-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/2500-118-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2500-115-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/2912-103-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/2912-126-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/4212-46-0x00007FFC6D180000-0x00007FFC6D4B3000-memory.dmp

Download

memory/4212-100-0x00007FFC6D180000-0x00007FFC6D4B3000-memory.dmp

Download

memory/5052-25-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/5052-28-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download

memory/5052-26-0x00007FFC6D4C0000-0x00007FFC6D7F3000-memory.dmp

Download