489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Size 17.9MB
Sample261009-ynh2cabv2k
SHA256 489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2
MD5 fae31a1b99b802d086777002b8e1d513
SHA1 25fd875e077d212ed298f53a549c98f63490aa4d
SHA512 628d964194d31c1a8493da38a162879c254b092cb8c05ae5f9bdf082006321aa0ffff56ff43b84fe1b992f89f869d43fbdb733ec3ba40e052c842b0ea4971d2c
SSDEEP 393216:nQdubMlQjO30tos6q73/+q22DBv8a9pmrcGHdp8dT:nJMhqwHq22DZ81r9u
TLSH
T1C517C001B3F52798F5FB8BB8867792069972BC299B11D2DF0120915D1E32BD88D78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\ARM\\Win32Container.exe,"	Win32Container.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2904	rundll32.exe
8	2904	rundll32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4296	Win32Container.exe
2456	Win32Container.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Environment\UserInitMprLogonScript = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCache60c1 = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCache60c1 = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\ARM\desktop.ini	rundll32.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3532	cmd.exe
3712	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2916	timeout.exe
4592	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5812	systeminfo.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\LocalServer32	Win32Container.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID	Win32Container.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}	Win32Container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\LocalServer32\ = "\"C:\\ProgramData\\ARM\\Win32Container.exe\""	Win32Container.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\ARM\desktop.ini:cache_svc	Win32Container.exe
File opened for modification	C:\ProgramData\ARM\desktop.ini:cache_svc	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeIncBasePriorityPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: 33	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeLoadDriverPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeProfSingleProcessPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeBackupPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeRestorePrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeShutdownPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeTakeOwnershipPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
Token: SeSecurityPrivilege	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3712	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	90
PID 3416 wrote to memory of 3532	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	91
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3712 wrote to memory of 2916	3712	cmd.exe	95
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3532 wrote to memory of 4592	3532	cmd.exe	96
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 3416 wrote to memory of 2904	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	92
PID 2904 wrote to memory of 5812	2904	rundll32.exe	97
PID 3416 wrote to memory of 2768	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	100
PID 3416 wrote to memory of 2768	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	100
PID 3416 wrote to memory of 2768	3416	489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe	100

C:\Users\Admin\AppData\Local\Temp\489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe
"C:\Users\Admin\AppData\Local\Temp\489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 600 /nobreak >nul 2>&1 & taskkill /f /pid 3416 >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\489109095909eb9b3d60db1a01178080073b068e535735a026d351d446bef1d2.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\system32\timeout.exe
    timeout /t 600 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 900 /nobreak >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ss_dbg.txt" "C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log" "C:\Users\Public\ss_release_debug.log"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\timeout.exe
    timeout /t 900 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4592
- C:\Windows\System32\rundll32.exe
  rundll32.exe
  2⤵
  - Badlisted process makes network request
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\systeminfo.exe
    C:\Windows\system32\systeminfo.exe
    3⤵
    - Gathers system information
    PID:5812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-first-run --disable-gpu --disable-extensions --disable-background-networking --disable-sync --no-startup-window --disable-background-mode --window-position=-32000,-32000 --window-size=1,1 --noerrdialogs --noerrdialogs --headless=new about:blank
    3⤵
    PID:2140
- C:\Windows\System32\rundll32.exe
  rundll32.exe
  2⤵
  - Drops desktop.ini file(s)
  - NTFS ADS
  PID:2768
- - C:\ProgramData\ARM\Win32Container.exe
    "C:\ProgramData\ARM\Win32Container.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Registers new Windows logon scripts automatically executed at logon.
    - Adds Run key to start application
    - Modifies registry class
    - NTFS ADS
    PID:4296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4468

C:\ProgramData\ARM\Win32Container.exe
"C:\ProgramData\ARM\Win32Container.exe"
1⤵
- Executes dropped EXE
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ARMHelper.exe

Path C:\ProgramData\ARM\ARMHelper.exe
Size 2.7MB
SHA256 323fee0ea61ed97c6cab4364972362fa68c7aedefa861f931ec89692b14c5018
MD5 ed6f0fc98a87bb0bee41d6aeb3b297c4
SHA1 e8a438c4d6a2c6a5b1cd1b87490fcaa86e467271
SHA512 9fe8c94d0cc8d42355d68d2779cf5958e22fe5234a483a80b9a385afb1ab5ec78845dea647e310a2256f1ac25a07d98a7b7132a809dd18af6477c930bf3094e3
SSDEEP 49152:UXSLHLM1xSIzOzyQepma2ulnSwNRgAGBRS1Dwf0Vy5W8JeXBC3fRcOx59dfzve:YHOIyeDsOSwNRg101scVyYlRWRZx5jzG
TLSH
T1F0D52316F68708F9D05BC17497428693A5B5B4860B327BFF139402315FAAAF21E3CB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\ss_dbg.txt
Size 401B
SHA256 ebcf5b3b4bf4b450aeb7379c051cf5260630c9f5920a564ce7358d68145ae6ea
MD5 a664c6ff910327904d4829c7c2a978cf
SHA1 a756c85f558e3c676f6685fb0e9616cf0a5f7113
SHA512 ba0f6b3be09900f6b99d4b24b14e6abdeab73b12169977c342e1e98fa1b7de630266f22b678ef99c27913a70c4659a9fd21834b7e66b8bbc5b286fcb8d508242
TLSH
T16AE092448F9C4EBB72451118F7AD7A25D424490C47690B00A506DB6285B0A63309A4E4
MD5 SHA1 SHA512 TLSH

Submit Download

ss_release_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log
Size 455B
SHA256 e8c4fc9cd27976e6c32f36036937efb79543db62172b3808820632f1da19acde
MD5 9a899135317fd1250bcf1cf8155b2c08
SHA1 3dd3ab707e2f1b31ad7cfed012874361e7a6116b
SHA512 a304814497762679fc8e1f46af29ba39cee281654b5a3b522ec99230e781e32a767a528b91ebcc95444310d7c5ca443ea1da577dd747b06c3464e55efc3523d7
TLSH
T179F0E5372DFA8580DC693A7FD1BDD26AF4528543ED50C812831294360D30A2FB43217A
MD5 SHA1 SHA512 TLSH

Submit Download

ss_release_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log
Size 46B
SHA256 dce1b9b28523bc11777010830dd4d8767cd5451d07cfb4cc8255f2156c0ea761
MD5 afbce0067f3bb515e550da2f871baa6e
SHA1 4b1366eed80e78847af4c914d57bf0c6d621f0af
SHA512 daf5d8f3ffb8edcff97fd6f92da0b3f7757a5a6f346bd57bd7cd112f6ce8d1e1ffcb2ac95136706a2294bd1225c5c6c8ea8d14324195ee5076c6ee662b97d666
MD5 SHA1 SHA512

Submit Download

ss_release_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ss_release_debug.log
Size 85B
SHA256 0e551400c6996c8f4871fb71a36a10693333a1ec77d7258efd8d2ad43fedbd77
MD5 b747759a0ed9714d09aaac9a9d599541
SHA1 b2f7b2ce10d14806ac458d6e9bdd34eecb10c01a
SHA512 41cb471e1c051c0b5a21610dc2660943fdb0fb5495c2e5c097544b3210111d9650107d95aaca62951652c2d9e04e284ed1a3f7aefcf0b2a8e08b58b468641341
TLSH
T145A011028CA88000CEB3322E80ECCA2AA0800003C020C0220300002A0C20A2FB0B0222
MD5 SHA1 SHA512 TLSH

Submit Download

ss_wdc_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\ss_wdc_dbg.txt
Size 415B
SHA256 8afddaf0b5092a3bb2af333f09e31eec92fb9a8d07f6d5bee54c415300adc2c5
MD5 5c22c5006c850ad366f94e0bef925e08
SHA1 4826a358fb84ccb454a100b013f39446b0118912
SHA512 86f19ecdb06112b599bf28d9f92abcc87e3bfdf789df843ca5966c5fc756d8c80c7cdd977a9682971a897a787dc5a3afd70cae4a32234adbaac60c7f55efa021
TLSH
T1A0E02B880CF261B78FD064D4305E7A4794E09F0E920F0B11BC68C6C1BFD511F55EC840
MD5 SHA1 SHA512 TLSH

Submit Download

yami_405551

Path C:\Users\Admin\AppData\Local\Temp\yami_405551
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_427649

Path C:\Users\Admin\AppData\Local\Temp\yami_427649
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_608082

Path C:\Users\Admin\AppData\Local\Temp\yami_608082
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_691461

Path C:\Users\Admin\AppData\Local\Temp\yami_691461
Size 138KB
SHA256 fbfae1033286b0ed007145fb651d1378062ed761ec7fe346639cb5c1c41f2674
MD5 e66aa010bd9f97c0eef6b97c0b859f1e
SHA1 2d07bdab734fb316cddd3d98172b3ca7b0ab4be8
SHA512 779bf86f80e2c00d8495ef433b7803636d962d137d5f3dac6d0988e510b3774c4743260556ccff02e414b5bf4016df0b25f861e4818e7ef1629f4ddc0b9e1da9
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OOJRVum9dnVr:FnbZeMrv/hGtORdn9
TLSH
T10DD3874B3A743002EDE59A722CE054BB5E3CB16D4F5595D428B620588EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_719005

Path C:\Users\Admin\AppData\Local\Temp\yami_719005
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_743696

Path C:\Users\Admin\AppData\Local\Temp\yami_743696
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_824201

Path C:\Users\Admin\AppData\Local\Temp\yami_824201
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_883697

Path C:\Users\Admin\AppData\Local\Temp\yami_883697
Size 224KB
SHA256 faad576265b7aa771efac6fe497f858970e447816045a553ae37750eff157d39
MD5 1f018c800525ec31c392407bb8f1014a
SHA1 8deaef41ee4453bb7a571d930cc62b25f1720567
SHA512 4ad0ecb095a1490d0d4e373a8b23457c89f1db0a5c9631f29e54385f71f5166ab7f24e925f1190ccb47b44bf8a310ace13035608b1ce274d8136c0e2ebd21d44
SSDEEP 96:bCjFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bJH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T18A24EF0E5F343722CDBD913669E644A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yami_abe_key_2140.txt

Path C:\Users\Admin\AppData\Local\Temp\yami_abe_key_2140.txt
Size 85B
SHA256 24df5158294a666e78c42c3ccc3b844ae5a61299fbcf30d2f1e871d7a10c31d5
MD5 2562984d5812af80c2d1323b3295f2ee
SHA1 8729edd4c2e7c8ba9e2bca67d213437ed762ef26
SHA512 abc37aae6737b5e5b01739dc211ddd1629a69572cac4b0fea51d0183974a7d7bb19b8743bd7b9ad77b704e0b4548e57debbc2e9f3a17e9224a89acd038060d03
TLSH
T137A01204B5655003D4C6A00981492368C08401654404B00440445529118B7E0E00C485
MD5 SHA1 SHA512 TLSH

Submit Download

yami_pipe.txt

Path C:\Users\Admin\AppData\Local\Temp\yami_pipe.txt
Size 77B
SHA256 84da590dac7720250fc40c63c42229b26cb31946987d9213e1402db5eb527e38
MD5 a6da3e4190783abd619bd9cb8d1736dc
SHA1 58426bf4b3c56d1bbc4df1ad0bbc3094a229bae8
SHA512 4cbd5c9917c078a508d6238b6714b9f3aa84b8f593831935026e62268c029c9d52ffe3f963556ea3d218210389454ecaea838f26d0e843076089e923da24f71c
TLSH
T1B2A012007082B9082908901F5461C14CC4552C0415442A248D10CC48C19D4C86344301
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-67-0x0000014D0C830000-0x0000014D0CA71000-memory.dmp

Download

memory/2768-82-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2768-94-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2768-78-0x0000016E24660000-0x0000016E24661000-memory.dmp

Download

memory/2768-137-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2832-70-0x0000019819190000-0x00000198193D1000-memory.dmp

Download

memory/2904-41-0x0000023571B20000-0x0000023571D97000-memory.dmp

Download

memory/2904-43-0x0000023571B20000-0x0000023571D97000-memory.dmp

Download

memory/2904-9-0x000002356E850000-0x000002356E851000-memory.dmp

Download

memory/2904-37-0x0000023571B20000-0x0000023571D97000-memory.dmp

Download

memory/2904-28-0x0000023571B20000-0x0000023571D97000-memory.dmp

Download

memory/2904-25-0x00000235703C0000-0x0000023570636000-memory.dmp

Download

memory/2904-26-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2904-16-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2904-13-0x000002356E9A0000-0x000002356E9A1000-memory.dmp

Download

memory/2904-1-0x0000000180000000-0x00000001800B9000-memory.dmp

Download

memory/2904-248-0x0000000180000000-0x00000001800B9000-memory.dmp

Download