6d3829f9d649a250f4fec733166142260df7a2a684ae89b86593384b14363628

Analysis

max time kernel
151s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
Size 70.1MB
Sample261024-1yxzcsxtdz
SHA256 6d3829f9d649a250f4fec733166142260df7a2a684ae89b86593384b14363628
MD5 0c25a0cccd126d4f4a177a6d8bd216c5
SHA1 8107fd3c53b8398b56a10da8a81b6115755a0336
SHA512 318f44377c5580c9637cfdb67a07936e320bc79e31b558747ba916fc002024666e16e739b46fb8c6eabc2f6bc62700c9e387f6484ed94f9e359a1ce1d0a126cf
SSDEEP 1572864:3rl0MjWPSy35hi1pQZrdFyAbxRZi5vX8rxMkMjsZT18oqMy7Us9:3rvjQiWywLrxMkMjsX8
TLSH
T1A3F7338E53A1A9BCE47906B41175CA3EC2753D069733816725F8FEB3B773BA10856E08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c45c-994.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c45c-994.dat	INDICATOR_SUSPICIOUS_References_SecTools

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe

Loads dropped DLL 37 IoCs

pid	Process
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
8	tasklist.exe

Queries system WMI classes for hardware identifiers 2 TTPs 16 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3128	powershell.exe
1964	powershell.exe
3712	powershell.exe
5964	powershell.exe
5400	powershell.exe
3296	powershell.exe
3188	powershell.exe
5396	powershell.exe
2320	powershell.exe
2848	powershell.exe
124	powershell.exe
1236	powershell.exe
2920	powershell.exe
2016	powershell.exe
5852	powershell.exe
4280	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4788	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3296	powershell.exe
3296	powershell.exe
3188	powershell.exe
3188	powershell.exe
124	powershell.exe
124	powershell.exe
3128	powershell.exe
3128	powershell.exe
5396	powershell.exe
5396	powershell.exe
1236	powershell.exe
1236	powershell.exe
1964	powershell.exe
1964	powershell.exe
2920	powershell.exe
2920	powershell.exe
3712	powershell.exe
3712	powershell.exe
2016	powershell.exe
2016	powershell.exe
5964	powershell.exe
5964	powershell.exe
5852	powershell.exe
5852	powershell.exe
2320	powershell.exe
2320	powershell.exe
5400	powershell.exe
5400	powershell.exe
2848	powershell.exe
2848	powershell.exe
4280	powershell.exe
4280	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeIncreaseQuotaPrivilege	3296	powershell.exe
Token: SeSecurityPrivilege	3296	powershell.exe
Token: SeTakeOwnershipPrivilege	3296	powershell.exe
Token: SeLoadDriverPrivilege	3296	powershell.exe
Token: SeSystemProfilePrivilege	3296	powershell.exe
Token: SeSystemtimePrivilege	3296	powershell.exe
Token: SeProfSingleProcessPrivilege	3296	powershell.exe
Token: SeIncBasePriorityPrivilege	3296	powershell.exe
Token: SeCreatePagefilePrivilege	3296	powershell.exe
Token: SeBackupPrivilege	3296	powershell.exe
Token: SeRestorePrivilege	3296	powershell.exe
Token: SeShutdownPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeSystemEnvironmentPrivilege	3296	powershell.exe
Token: SeRemoteShutdownPrivilege	3296	powershell.exe
Token: SeUndockPrivilege	3296	powershell.exe
Token: SeManageVolumePrivilege	3296	powershell.exe
Token: 33	3296	powershell.exe
Token: 34	3296	powershell.exe
Token: 35	3296	powershell.exe
Token: 36	3296	powershell.exe
Token: SeDebugPrivilege	8	tasklist.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeIncreaseQuotaPrivilege	3188	powershell.exe
Token: SeSecurityPrivilege	3188	powershell.exe
Token: SeTakeOwnershipPrivilege	3188	powershell.exe
Token: SeLoadDriverPrivilege	3188	powershell.exe
Token: SeSystemProfilePrivilege	3188	powershell.exe
Token: SeSystemtimePrivilege	3188	powershell.exe
Token: SeProfSingleProcessPrivilege	3188	powershell.exe
Token: SeIncBasePriorityPrivilege	3188	powershell.exe
Token: SeCreatePagefilePrivilege	3188	powershell.exe
Token: SeBackupPrivilege	3188	powershell.exe
Token: SeRestorePrivilege	3188	powershell.exe
Token: SeShutdownPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeSystemEnvironmentPrivilege	3188	powershell.exe
Token: SeRemoteShutdownPrivilege	3188	powershell.exe
Token: SeUndockPrivilege	3188	powershell.exe
Token: SeManageVolumePrivilege	3188	powershell.exe
Token: 33	3188	powershell.exe
Token: 34	3188	powershell.exe
Token: 35	3188	powershell.exe
Token: 36	3188	powershell.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeIncreaseQuotaPrivilege	124	powershell.exe
Token: SeSecurityPrivilege	124	powershell.exe
Token: SeTakeOwnershipPrivilege	124	powershell.exe
Token: SeLoadDriverPrivilege	124	powershell.exe
Token: SeSystemProfilePrivilege	124	powershell.exe
Token: SeSystemtimePrivilege	124	powershell.exe
Token: SeProfSingleProcessPrivilege	124	powershell.exe
Token: SeIncBasePriorityPrivilege	124	powershell.exe
Token: SeCreatePagefilePrivilege	124	powershell.exe
Token: SeBackupPrivilege	124	powershell.exe
Token: SeRestorePrivilege	124	powershell.exe
Token: SeShutdownPrivilege	124	powershell.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeSystemEnvironmentPrivilege	124	powershell.exe
Token: SeRemoteShutdownPrivilege	124	powershell.exe
Token: SeUndockPrivilege	124	powershell.exe
Token: SeManageVolumePrivilege	124	powershell.exe
Token: 33	124	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4780	4768	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	89
PID 4780 wrote to memory of 3296	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	90
PID 4780 wrote to memory of 4788	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	93
PID 4780 wrote to memory of 8	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	95
PID 4780 wrote to memory of 3188	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	97
PID 4780 wrote to memory of 124	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	99
PID 4780 wrote to memory of 3128	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	101
PID 4780 wrote to memory of 5396	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	103
PID 4780 wrote to memory of 1236	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	105
PID 4780 wrote to memory of 1964	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	107
PID 4780 wrote to memory of 2920	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	109
PID 4780 wrote to memory of 3712	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	111
PID 4780 wrote to memory of 2016	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	113
PID 4780 wrote to memory of 5964	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	115
PID 4780 wrote to memory of 5852	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	117
PID 4780 wrote to memory of 2320	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	119
PID 4780 wrote to memory of 5400	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	121
PID 4780 wrote to memory of 2848	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	123
PID 4780 wrote to memory of 4280	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	125
PID 4780 wrote to memory of 4224	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	127
PID 4780 wrote to memory of 944	4780	2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c25a0cccd126d4f4a177a6d8bd216c5_blankgrabber_coinminer_dosia_icedid_luca-stealer_njrat_quasar-rat.exe
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4788
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:3128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:5396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:1964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:3712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:5964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:5852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:5400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:4280
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe --globoff -s --fail -m 20 -L --max-redirs 3 --compressed -A UnlockTool https://darsunlocker.darsmail.com/monitor/collection.php?action=update -o C:\Users\Admin\AppData\Local\Temp\dars_update_4780_1796_9uidh_xe.json
    3⤵
    PID:4224
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe --globoff -s --fail -m 20 -L --max-redirs 3 --compressed -A UnlockTool https://darsunlocker.darsmail.com/monitor/collection.php?action=update -o C:\Users\Admin\AppData\Local\Temp\dars_update_4780_904_k91lsy5g.json
    3⤵
    PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.mid

Path C:\ProgramData\DarsUnlocker\.mid
Size 16B
SHA256 2d452d24b63061d3e533c3d77cd5217c0be36d7f2a014349f27c6ae192e70dc5
MD5 4d5bde6c3f100b98365351f787a2feb5
SHA1 26ace0b45dd34a717ecfdc7e78486b9434cde8b5
SHA512 c2e1569abe7c9a4e91bdfd72c12f0a4984096b49c8b93739a4e7d2757959746b990fb70f5ebd8ffdb6f8a41b501a16538d78396ed2dde67e3cc366e19e7c4e07
MD5 SHA1 SHA512

Submit Download

trial.dat

Path C:\ProgramData\DarsUnlocker\trial.dat
Size 204B
SHA256 f8806095ff1d4bec201fc5902af150205eb11b62fd0b3e7272f9ad172d496999
MD5 0d14ecfb5e8dd9d60b3d875b210847a9
SHA1 a681deb8d824249e785dce1074ab15cd6aebc39a
SHA512 71fdbd7090b6c839c41cda4b6bf5e47daae1d9ad6944afa5b006e2dd583aab8ee9bcc5d636f6538f1ffcf1ccdfcdb42b35938e7dfbdb7d8edf73ca8d62d9946b
TLSH
T1C0D023380455261774402310259D5896C72CE314091AD49C230DE361578D3799B46904
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ozhbd3r2.dsu.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozhbd3r2.dsu.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 7d1b252adc643deeb896430b58cf457436152351eb7fa043b4b24736c9edf864
MD5 5b855b3e838d9c7faad4bd736cf56d59
SHA1 ad51237a6e2d1beefddabfc8bd8ac0e205ed735f
SHA512 180207b3bd88976240eccf39f2f174af0d13feefd9b22b92363c0d947e8bd5b1523417a73d4b5aaf9252a59162e34e2f5df76c837cbd1b458d1830f4d4c70918
SSDEEP 192:HjNF/1nb2eqCQtkluknuz4ceS4QDuWA7cqgYvEP:D52P6luLtn4QDBmgYvEP
TLSH
T10C52078AF26781FAF52B4075CD730A8B9A79B50027512BCB6360C2475D237E6323E7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 84e071321e378054b6d3b56bbd66699e36554f637a44728b38b96a31199dfa69
MD5 a1b78a3ce3165e90957880b8724d944f
SHA1 a69f63cc211e671a08daad7a66ed0b05f8736cc7
SHA512 15847386652cbee378d0ff6aad0a3fe0d0c6c7f1939f764f86c665f3493b4bccaf98d7a29259e94ed197285d9365b9d6e697b010aff3370cf857b8cb4106d7d8
SSDEEP 192:HKF/1nb2eqCQtkrKnlPI12D0gacqgYvEn:A2P6KlPe2D4gYvEn
TLSH
T1BC42294AFAA589FDF82B8275C4730A49A5B6BA0037506BCF0371529A1D333D2333A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Cipher\_raw_cfb.pyd
Size 13KB
SHA256 2a63e504c8aa4d291bbd8108f26eecde3dcd9bfba579ae80b777ff6dfec5e922
MD5 0dca79c062f2f800132cf1748a8e147f
SHA1 91f525b8ca0c0db245c4d3fa4073541826e8fb89
SHA512 a820299fba1d0952a00db78b92fb7d68d77c427418388cc67e3a37dc87b1895d9ae416cac32b859d11d21a07a8f4cef3bd26ebb06cc39f04ad5e60f8692c659b
SSDEEP 192:PRgPfqLlvIOP3bdS2hkPUDkfoCM/vPXcqgzQkvEmO:oYgAdDkUD1CWpgzQkvE
TLSH
T12D522809F79844BCF86B41B9C973091A9AB9B554331123DF0320919E2EA3BC13B3EBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 b2b68de1d7e5997eb0c8a44c9f2eb958de39b53db8d77a51a84f1d1b197b58b1
MD5 785f15dc9e505ed828356d978009ecce
SHA1 830e683b0e539309ecf0f1ed2c7f73dda2011563
SHA512 16033b72be6d66ab3a44b0480eb245d853a100d13a1e820eff5b12ce0bb73e17d6e48b3e778d1b20d0c04fe1fb8a5723c02ed8af434ae64d0944f847796d98f2
SSDEEP 192:OJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDrYDjRcqgUF6+6vEX:uE1si8NSixS0CqebtDErgUUjvE
TLSH
T13A621B19E69005B9F66642B888724E0EA7FEB4042342BBDF137592692E137C4333F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 ea96505b38d27c085544fb129f2b0e00df5020d323d7853e6a6a8645ac785304
MD5 aec314222600ade3d96b6dc33af380a6
SHA1 c6af3edadb09ea3a56048b57237c0a2dca33bee1
SHA512 bbc00aa7fdf178bb6b2d86419c31967f2bc32d157aa7ee3ac308c28d8bf4823c1fafcde6c91651edc05c146e44d7e59e02a76283890652b27c52f509c3b9ef9a
SSDEEP 96:kF0KVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EpmFWLOXDwoUPj16XkcX6gbW6z:yVddiTHThQTctEEI4qXD61CkcqgbW6
TLSH
T1D222E88DFE9189EFEA2581B586630E4AE179B711171273CF0370962E1F663CB317A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Cipher\_raw_ofb.pyd
Size 12KB
SHA256 084e4b2da2180ad2a2e96e8804a6f2fc37bce6349eb8a5f6b182116b4d04bd82
MD5 4ed6d4b1b100384d13f25dfa3737fb78
SHA1 852a2f76c853db02e65512af35f5b4b4a2346abd
SHA512 276201a9bcb9f88f4bbac0cd9e3ea2da83e0fb4854b1a0dd63cff2af08af3883be34af6f06ece32fad2fd4271a0a09a3b576f1ed78b8a227d13c04a07eaf0827
SSDEEP 192:HjF/1nb2eqCQtkgU7L9D0u70fcqgYvEJPb:j2P6L9DHAxgYvEJj
TLSH
T110421889FAE589FDF5268276C4730A45A5B5BA1027906BCF0320525F1E233CA377A786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 55e20e1effe80f0d6655d690fa445659e0c692b800c4a01ecf3d43dfcb3324b2
MD5 c482fe81df435cddef783ab0d8ad78b6
SHA1 25e0e650f9135110234091d5263be1721b8fe719
SHA512 ef5a965b8505944e6b37581763cd9d525bbf1b877bfed319535aab675d0382b8655cd6a4f2832f608c1d89cfd0dae6005deda73a86b9d2d6e874953788ee0d36
SSDEEP 192:HvF/1nb2eqCQt7fSxp/CJPvADQJntxSOvbcqgEvcM+:f2PNKxZWPIDqxVlgEvL
TLSH
T139520855F6A544FEF96682F980B30A0D92F9BA12936177CF1320526A1D237C0727E3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD5.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Hash\_MD5.pyd
Size 15KB
SHA256 49e10215e1d6966b03470af10e7d3b8bd5b5d6707a258c3b1286ff002145e3d1
MD5 9de2cfd4fe88f9e8e3820ce931fc1129
SHA1 c2ea2284200ebbdc1179f36e8fa79f9ed0b27e80
SHA512 c6d0e43df0e8f8e665bb1a78005a04f673e6b5211db0a0f1d640088782d736838944f0612a59a3c0cb930631108b93fd8c2d51bf191a81a06fb6d5a3388cff06
SSDEEP 192:CnZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZsRBP0rcqgjPrvE:CCA0gHdzS1MwuiDSyoGmDGr89gjPrvE
TLSH
T161625C08EA6145F9FA6981B8C0634F12A7B47925636167CF03B592AE0D337D1F37A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 044b09a6351db40fe1f242c70942d865ce4cd42a12f24e358f84ae790677d92d
MD5 67e8ab67b5db0a50af2aedea886eb362
SHA1 a7d071a3be454b78a0a0bb100e5d9859c12f98e6
SHA512 b2e41422b6642e000d9220a1cf4188b1845a8cf9498338d66ca0dcc0724540694719a4d3eda017ca6f2f77c3d6a6c427c6c86db3910c686cecb58a40c5239e2e
SSDEEP 384:CIPHdP3MjeQTh+QAZUUw8lMF6DE1tgj+kf4:CaPcKQT3iw8lfDSej+
TLSH
T1AF823B95FA6998BCE62D8830C6934B1FA376B5074761A7CF03E002ED1C173E66934B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 c6cd3f23d027febdf48161d3b74edb6c9d4d1bde23f775990f49572d8eb9dfb9
MD5 7a573f50bd6942e9bb68307e5b6a0bff
SHA1 7e0e435c8589ec3cecfe6354ae9e5ae868b9b209
SHA512 9ecd754b99e020a169366cb8c99816070221c4db2c1ef8c23b6dac765e6bb56ea3abbe969025aecede8eb6c3ea8c626562f2cda3c4ea537c5db1a841f19c2ad5
SSDEEP 384:CtljwG2JaQaqvYHp5RYcARQOj4MSTjqgPm4Dw8regjxojS:C/jwLJbZYtswvbDw8r7jUS
TLSH
T1D5A2091CDF3C41A4F90E603AAB73466A77B9F51093A4B3EF871109291C2B7EE563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_clmul.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Hash\_ghash_clmul.pyd
Size 12KB
SHA256 ba4c1492bb4884f3d77f61a7d23ec9e190eb7da3a115a271d0954d933264fb71
MD5 88e3148d1eb84022e508736d0d488185
SHA1 4d1d3251cc5e61c7fcf5dc6273e3d7ba301d6ca9
SHA512 25a86c56b84275c2314ad1fd98635b43373977dfc6f2f6737f22b1962a3bb5480539a35db9fbb70fca16f5acb5f19bab63e1cada776d1667d07332322f641a5f
SSDEEP 192:6RF/1nb2eqCQtkbsAT2fixSrdYDtrymjcqgQvEW:6d2P6bsK4H+DcwgQvEW
TLSH
T1FD42194DE6A642FDE42642B9C87B474AA979754827E0A7DF036280790D333C2333DBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Hash\_ghash_portable.pyd
Size 13KB
SHA256 e7a7ab2d31aee3b99773c814114d60eb71107ef862930c582f99313943249163
MD5 1a3a27f63afeb42c0282eada02ac834a
SHA1 fadda44628aef3ec70cc02fc0e43a88c7832f7bc
SHA512 0d6d397f87cc5a8a83f1df20687c967df4faf80cf0807ae2b06969e16c107f18a5d39ce34c32c42a53d1726a50860c180266ecad81b4235f041920f496b25fc7
SSDEEP 192:HeF/1nb2eqCQtks0iiNqdF4mtPjD0MA5LPYcqgYvEL2x:02P6fFA/4GjDYcgYvEL2x
TLSH
T1F952068CF29049ADFE66817486770B0DB6BDB92437416BD70362A2990D233C2317FB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 880a4418d81c4da0d588c0cfd7c68d8c5476385d9203a2d6ded25a0f7b330a76
MD5 dd7d22a0afe540c07ce9d919cd779203
SHA1 0e76db96ec2d9922937a77abedb7e61037cc8cb9
SHA512 bd720cf67e264040f8076edbb72843305094f1d87bd03a1e9fbeb47564f3963120d76bad6887fea560b45958f2ffa929a7d63ea1ec9b633da23784d98a68c32a
SSDEEP 192:lCkCffqPSTMeAk4OeR64ADp6i6RcqgO5vE:lAZMcPeR64ADT63gO5vE
TLSH
T19E422A09FAA488B9F56B8139C4730A0AA9B9B61057617BCF0361D26A1D737CA323D7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 72998624c023b21f21e449f3268b7e839b248ba55440087cb6b421ed65f9a1b5
MD5 a9b7c866c5a18cc96570cca3be6a2433
SHA1 4f78c7516e512529b977048bc87ed3a95383b44e
SHA512 ec890e84384c7b1804ce73b097ef068bada15adb5f76e1e9b2bcc54cde910165a9729f40a1ac18d196ddd3ee4ee60a0cfaa6d56daafcad10630ad2658faf485b
SSDEEP 96:kDJVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EVAElIijKDQGGbM6YJWJcX6gbW6s:6VddiTHThQTctEEaEDKDKMRWJcqgbW6
TLSH
T17922C98DFE9289EAEA258178C5674E4AE179BB11172273CF1370957E1E633C73136381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 f2718adadb6e9958081dcb5570ef737c66772c166a6ad8c0401adcd9a70f46a0
MD5 5738d83e2a66b6ace4f631a9255f81d9
SHA1 5b6ebb0b82738781732cf7cfd497f5aeb3453de2
SHA512 bb21b62fd7fee22dfa04274d0fa1aec666c7845cd2ec3f01f1a0418a2c68f228ec0ae451c793ccae3aa88f1efee5d6019138c0975497518f990b8511b2fd0e75
SSDEEP 96:k0yZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DOWMot4BcX6gbW6O:XQVddiTHThQTctEEO3DEoKcqgbW6
TLSH
T19722FA8DFE9249FFE62982B5C5774E0AE179B710171273CF1374966A1E623CB312A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_bz2.pyd
Size 78KB
SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
MD5 d61719bf7f3d7cdebdf6c846c32ddaca
SHA1 eda22e90e602c260834303bdf7a3c77ab38477d0
SHA512 e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
SSDEEP 1536:IzXz7Bgrj7FUHfuwtvm8hbvwyhIvtVx7SywqLZ:kXzVMFOfuiRhbvwyhIvtVxiqt
TLSH
T1A3838C92B3A495B5F05BB27985B10357E371BD0D03A093AFB794822F2F03B816D6536E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_cffi_backend.pyd
Size 175KB
SHA256 e029cabce12aea3d77f2c8709a0f4be695f3fedd1144c14607b4fcc3b9e9bc3a
MD5 bd4f32abef9b144a79bb2b9d49dcc3e7
SHA1 685cf988a4e7f5b6455938b5435b140129fd8649
SHA512 8e073f6df0a4bed82aff8c3c5ede33f550e7249a7f5ecc33792575b15668424416ec22735da27d46ee07ff4973975d5f072dbc2ccfc0b971513cf524494d8fb5
SSDEEP 3072:y/GKmA40lyA5iS+IXe6YxL0/4zRMWZjpSo9k7nbjP7PFSTL7KC4+bAFbDQf:USA5N3YxL0/4lMWZjwb/TFSTLOiSD
TLSH
T108047D5A329C11B2D6A251388A575B53E3B3B470174197CF0170C6B52F2BBE67ABFB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_ctypes.pyd
Size 117KB
SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
MD5 3fc444a146f7d667169dcb4f48760f49
SHA1 350a1300abc33aa7ca077daba5a883878a3bca19
SHA512 1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
SSDEEP 3072:sW66GKh4hqyIVQoavMSutRSfrSd4etFx3FIvQPVv96:T6QKtkSu3SfrS3xr4
TLSH
T114C35A1B235400AAEA67507CC5B35E47DB71B859572083CF02A4C69E2F67BE36E3E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_hashlib.pyd
Size 60KB
SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
MD5 0d75220cf4691af4f97ebcbd9a481c62
SHA1 dadc3d5476c83668a715750ed80176dbbb536ec7
SHA512 c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
SSDEEP 1536:J7ejSMEDZN4ghT1mjWvfJ3ZIv5Ihp7Syif:J7ejrE/Tp1mjWHJ3ZIv5I3Af
TLSH
T10B537C06A74440A5C57383B8D9930FABE672F5845311A7EF5364C28E2F237C367BA791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_lzma.pyd
Size 151KB
SHA256 75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
MD5 afff5db126034438405debadb4b38f08
SHA1 fad8b25d9fe1c814ed307cdfddb5cd6fe778d364
SHA512 3334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc
SSDEEP 3072:m0k3SXjD9aWpAn3rb7SbuDlvNgS4fWq0znfo9mNoXTSlvpBAxhIve1xc7:m0kiXjD9v8X7EukAwYOXTCexo
TLSH
T136E32892A394F0E6F3628C38D6624F57D7F578090320929A02CC976D2B1FB759E2E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_socket.pyd
Size 74KB
SHA256 9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
MD5 f59ddb8b1eeac111d6a003f60e45b389
SHA1 e4e411a10c0ad4896f8b8153b826214ed8fe3caa
SHA512 873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf
SSDEEP 1536:vmtvsZWgzruIAe9/s+S+ppyXc/+lvFIvQwx7SyWDd:u5IJzrAe9/sT+pp8c/SvFIvQwxQDd
TLSH
T1EE734A12A69051B9D67381BAC5635F23FB70F490179593CF1260CA6E1F237829E3EBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_ssl.pyd
Size 153KB
SHA256 41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
MD5 80f2475d92ad805439d92cba6e657215
SHA1 20aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab
SHA512 618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5
SSDEEP 3072:09Y1GpXg28PqCBWZxVkc85/u9NkFc8j8V+AOXLkdWXxZIIkjIIhIvt79oF2:09Y0BgdqCETaXu9K6V+RrIE
TLSH
T1F9F37C47F28419A7E813E4BDC6630A42E7B5F045231197CE49D6C68A0F13B46AF7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\_tkinter.pyd
Size 61KB
SHA256 3ddcdec7a7a9b01f1af5a57f3cd66ae68883416fa7fb6aa7fa51b9cf1c24bf07
MD5 5954a0102a4c2e6e0f71ceb2f6259fc9
SHA1 99b96da37baee75f0ab2d2165c8f194f26aa2041
SHA512 5a986b2d931ea09048bce1d5816e9c8aaa63aeae48e4b5d844013e16a0229207553b4aabb4a790f55bcc5f5e0fabc5c819045b22d1d2e0eec9fe7ddcf1cba94d
SSDEEP 1536:ksT+oBVHute481CHVg7N/yNZIv5Ss7SyM3S+:ksT+oBRGpHVg7IZIv5Ss23S+
TLSH
T1EB537CAB6BA4009ADE67C139C5B34F17DA75B4110A20934F0298D34A2F337E35BFAB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decrypted_loader.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\decrypted_loader.dll
Size 23.5MB
SHA256 a5e6e173fccd33111f8c379bf7b2c0fff749e29e29085b838e6f8601f862903b
MD5 44b800ff0287bae32e7179cdbaf0980c
SHA1 598955b4c7b771769a2d689f44fe89142c9a4e20
SHA512 9f41bc72c8b4ce2a19f7fbaeb7d699ff1843b378671f6f5945e5a0cda7eeb355da47bca47db62d6a235b38a4e3723fd6b704617ba484381aef34fe4cf2d699a3
SSDEEP 98304:oQ6G4juC8uWcw1sP76RTWQ0+zrEG6g+kxecQGiJHEjad4M45rBoUBcgPR0zEWbjg:oR0TbRTWMrLUkkcQ2WbjKO21E
TLSH
T12847F85111881086E6A6EB7DBE26DB86EEB17C09330B16DB10D9B48D7B77CA506FF04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
TLSH
T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
TLSH
T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\python310.dll
Size 4.2MB
SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
MD5 e9c0fbc99d19eeedad137557f4a0ab21
SHA1 8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA512 74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
SSDEEP 49152:sjpL4R07dkqlAC+j5mum37j64+QNdhIomafXXPoMpBdr3AtoD1s3tvVIdHwHasMD:sjpPkqe1t4zf3Ty9ydQHvMl/SE98EL
TLSH
T111267C22A26411A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\select.pyd
Size 26KB
SHA256 149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
MD5 994a6348f53ceea82b540e2a35ca1312
SHA1 8d764190ed81fd29b554122c8d3ae6bf857e6e29
SHA512 b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f
SSDEEP 384:rPjk/7e12hwheCzHqNYBsVRX+MIv7GnIYiSy1pCQaKEJ94i/8E9VFShf:TUC2hwhHHqyYVFIv7GIYiSyvQJ9eEwf
TLSH
T1D3C28F56AB909C86E8238571A5E58F06ED35B6A04720C3CF3365C21D2F12BC177BB76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\tcl86t.dll
Size 1.8MB
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf
SSDEEP 24576:aNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBH9:aNgjid2LD5W4ac6xdLvIkhHP4ATdeD0
TLSH
T1A785AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\tcl\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4768_734735_LFa5oU__-cs\tk86t.dll
Size 1.5MB
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9
SSDEEP 24576:C1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOJ0wd98ydeyRP/ecr:CIyQD9FU43GLUKuPO6EinYTVAFSvESKI
TLSH
T178655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 8e4d065c08d62e7f95b5f7532ebcc24f8166d9ce737d65ddd782e6d19d75ed8b
MD5 967a7dc6f2dbd7b9f8a90112b9ce642b
SHA1 db09d12b172e55144eab53dfd546b0abe72e1266
SHA512 532832966d23860093627ab5ae5d00e164eb528c34cba7706b23a4ab98a0c53c38851d9cdb53e001c3de51b43e4173954310c4766ee7ef20d2cbd481f925ee1a
TLSH
T1F421D236066991AD25F70995092CB52FE31FC0DF0E2B99883E9F510F3BA9A0C6323746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3188-1083-0x000001C9CF900000-0x000001C9CF9B2000-memory.dmp

Download

memory/3296-1061-0x000001E6ED280000-0x000001E6ED2A2000-memory.dmp

Download

memory/3296-1066-0x000001E6ED300000-0x000001E6ED30A000-memory.dmp

Download

memory/3296-1065-0x000001E6ED6B0000-0x000001E6ED762000-memory.dmp

Download

memory/3296-1064-0x000001E6ED470000-0x000001E6ED48E000-memory.dmp

Download

memory/3296-1067-0x000001E6ED8F0000-0x000001E6ED91A000-memory.dmp

Download

memory/3296-1068-0x000001E6ED8F0000-0x000001E6ED914000-memory.dmp

Download