salatstealer | c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc

Analysis

max time kernel
23s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
MD5 cadb63e600829d6d26aaac973d55d89d
SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
TLSH
T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral11/files/0x000d00000001c4d7-3880.dat	family_salatstealer

Executes dropped EXE 2 IoCs

pid	Process
1328	Setup-bTbvWlUQiXYpayRj.exe
4400	agent_ZvNJTYMI.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4692	certutil.exe
2608	certutil.exe
5176	certutil.exe
1308	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4244	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_ZvNJTYMI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_ZvNJTYMI.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_ZvNJTYMI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3384	4244	cmd.exe	90
PID 4244 wrote to memory of 4692	4244	cmd.exe	91
PID 4244 wrote to memory of 1328	4244	cmd.exe	92
PID 1328 wrote to memory of 4400	1328	Setup-bTbvWlUQiXYpayRj.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3384
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Users\Admin\AppData\Roaming\EnableMount\agent_ZvNJTYMI.exe
    C:\Users\Admin\AppData\Roaming\EnableMount\agent_ZvNJTYMI.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4400
  - - C:\Users\Admin\AppData\Local\Microsoft\conhost.exe
      C:\Users\Admin\AppData\Local\Microsoft\conhost.exe
      4⤵
      PID:1148
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:4540
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe" -
        5⤵
        
        PID:2304
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:6116
- - C:\Users\Admin\AppData\Roaming\MeasureDismount\agent_UIkNxmaI.exe
    C:\Users\Admin\AppData\Roaming\MeasureDismount\agent_UIkNxmaI.exe
    3⤵
    PID:3404
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5176
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2300
- - C:\Users\Admin\AppData\Roaming\Sun\agent_uRMpSsLZ.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_uRMpSsLZ.exe
    3⤵
    PID:904
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:3352
- - C:\Users\Admin\AppData\Roaming\CompleteResolve\agent_rxdLnmKx.exe
    C:\Users\Admin\AppData\Roaming\CompleteResolve\agent_rxdLnmKx.exe
    3⤵
    PID:1708
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

conhost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe
Size 2.6MB
SHA256 cac7f7f75c366096242836c8150bcd355e1bfee0a097dd009e57580bb232c22c
MD5 5d341ef41e937f951b87a423aedb5971
SHA1 dd2d276a1562ab6e0225b50d01452df6dd8f0375
SHA512 b3720d85da6d316cec128bf7f882b416bb0ead41f620751e2b05522a3c4d2cf737dc5a7d4cf98e35b5e74689d6700bf4687bd1ed0e33df7b9e6f1ac9458f1371
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRJ:icVUcTedI6C9e9J
TLSH
T1FFC5C664EEEFC1F5ED435C30115BB23F6B3522098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe
Size 3.0MB
SHA256 9a60ed25ea99a914719ecd212bcc1e8ad849c929836dd268d06688d63cedd73e
MD5 16d47fadfdd313041a14664e08d9c5d2
SHA1 fa037331f86a545f10db69f2823ec2517c69305e
SHA512 38fb3e7a836979f046d61cbbe8b205bd54841e51dd3152fa9556180017d76392b2d8cdfefbc7b1e94d73d2f60e9fae50a80364775c8e072500a9351d6e415957
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIu:icVUcTedI6C9e94
TLSH
T14BE5C664EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\conhost.exe
Size 3.5MB
SHA256 df90eb498ef839e823d5c47e8bd13f6553a2167bdaf1cdd03d7594750cc44b92
MD5 878ab9cec852531e81f608c6cf18dd60
SHA1 b9355af4713d5927a2740cebb3e11f6be1687205
SHA512 0769bb78463cacb97f6ef812a8e8d7e7b20aac64c8c03211e635670a8d2f6a47e3eb28ad4e66a993b3ce99b22fb2f02ce4261cf2dea0d4d5b3c0dd3eff13f038
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fK:icVUcTedI6C9e9MZ
TLSH
T16A06C564EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\conhost.exe
Size 3.7MB
SHA256 b8510f465ff8bcad8413c492e4d3fb221bdcd35d726a402ac45ffbba756bf0d3
MD5 e445c9373c696ff9cbcc4de392a8dded
SHA1 f2efdc489e0a5d5a083eeb01617c527781eecb66
SHA512 60f677fee65a0717ec3c23fdc1fda78ef5828adaaf55a53cfd9f6859ce94d2b1b4acfa02ce5324bff0f35a81224afc4092d5f8cb58fc17be68b24d6009b1b678
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW27e:icVUcTedI6C9e9MQR7e
TLSH
T14606D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 5.4MB
SHA256 273ac72aa024ea7d06643cff3f9c87c9f414f2bd8467c12f347721f4fbc87576
MD5 64d2fe63957ba161789d4eecdae92361
SHA1 9e3868fdaba2374ceee024fe1b591045de95ac84
SHA512 a734c41f4fda6877caa6c3f95442ea30695ce49e62aa3a253ebee552b26e03b0a4c73853cc151f1d4dd7c5ca77e048279e2b6bdd3549e01f678c2daf49cb1beb
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eNX8m:06GtcbPy/lwHVSavaeNb
TLSH
T1CF464A13EC6555E8C0AED2358A729123BF617C881B3163D32BA0F6252F76FD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.0MB
SHA256 d53af0073bd5dda27c435c68a58ad91adcbfdbcaa96a3847c99cbe549d188769
MD5 cbb59aca1e093788d96003bb01b77b48
SHA1 0bec1a1e55f4714b9db34b95fa01950ff57fa882
SHA512 79e5bb321790444a5a25cd30cf08d3e5d1e398c8a9ab77dbce15192ccd6c7d1bfd97fec70f079d901e22681eae7328173e8599d2525bb5eb72f9b05cef975caf
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViF:06GtcbPy/lwHVSO
TLSH
T14CE5E757ECB950E8C0EEC575C662E623BE613849433433E76FA19A201F1AFE0A5BD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 f1b8aaa0240f3e9a089b15e044cc3b2417dae0158a8d68b85fa994488bbd99c7
MD5 a5d5a63a162aee195092536b056ef517
SHA1 403e9517c90da254a1683ec0633cf7ed87e6f8a5
SHA512 2b88e8c1eeb680599c3108fe05a92573a4da4ccf0498ee463c6dd2cd1d2c677f2bda2799af9e01b0d951c84e84be4467e2a76d2b349e2232cf40cfab28e93bb7
SSDEEP 384:zcv1QzG+l1V4HsehzIz0DZx2+h4NnE1UwRaTw8:zA1QzG+1V4drVIN+T+w8
TLSH
T19C722937B342ACBB5FC9C442A88506C16C9CB193A0F4E694630D45BD61AB7B92FBD4DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 9.1MB
SHA256 f3d5d778cce0b4a1fd92fa746eedb87924c23f1025c8ea717fa50bd08efdfbcd
MD5 e996970e40578292361ea865fe08e331
SHA1 5ba95c1cd7a8ce520fe03e1e5a37330780b79abc
SHA512 c3cd5d19eb52be479c79a710623eb1a1a851ccb3c1647a5cd338d09652af4ff04e5ccab7a515d10d437d0f7d54ab82e89d578ff6413fa3c5fe6e915cbd30e649
SSDEEP 49152:FjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfMwHzSycLXypwutu0okH4MmQY:X
TLSH
T1B1A6F1721643FDDA5F790D45D0093A815C9C796B5294E2E8FF8E31AB31EA610EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 180KB
SHA256 647d2af7c826d954427d9f8301ab590aaa25d6651883f7d45288bd2783983ab8
MD5 bef8e2f5de18a0e81e9e08b8f1a4155e
SHA1 024b68bb5d196c3d8b34dc1d05fcf5cbf8a56d5c
SHA512 0f962b02a78bc3ed797d50e1cc836157b9d700a2abd7186b8ad6705bea89aa5e00dd35cfd33439e05b764eb5c8566cf2121d312b917302ad25ea5eaff42d7ded
SSDEEP 3072:9O7uv/LpHmdDa21nnrIWd3lcBR0BH2GN7nav35kvH:WY/lmRamnnc6OUmvSvH
TLSH
T1CE04193506E770BC38FC3D9665220D4D5D9D2B0E15BA030767C571BAA3AD5E8CE28E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 4.3MB
SHA256 e5ea208801f5e27b78fd462499e9a36e63116fb8ed82b85b3a1db0f88c929b23
MD5 32984f8c1af85f96ee9243a91738af09
SHA1 bda3ddb1baa8cd40731b2f6232cb51ef666237de
SHA512 d03ed2b20e1cac9549e7e9cdd35f8d70a914df8e11fbdc5d72f28700d46fd47bfbe8f8defa78d7ec7905f5f340b7445ca53e825e2e58e70d8e0c68f4f82d232b
SSDEEP 24576:VDfmPaxImHKiJt8oz5NXn0lA5rd6N1vJvKzEMZeuDl68e3d5PbqXkDfQQKiRiTJb:VDvxPdJB5N304rSRCBe3rVBNRoz/YJ2
TLSH
T18B266C360693BDBC3FBD3D45A4012E495D5D760F2179834ABB8834BE63AD4A88D2CD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vv2fhs5m.ige.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vv2fhs5m.ige.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_ZvNJTYMI.exe

Path C:\Users\Admin\AppData\Roaming\EnableMount\agent_ZvNJTYMI.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_UIkNxmaI.exe

Path C:\Users\Admin\AppData\Roaming\MeasureDismount\agent_UIkNxmaI.exe
Size 8.3MB
SHA256 1990fa1b4de350b297799df7b51a13109bd8a2ad2f0ca99276d6c933100e5747
MD5 c07ae1047ee9844349656c31ab60a68f
SHA1 904f8e7432bc95f7eb3f787d16a4041c118e00e3
SHA512 92923ed7e075b0e6e0af351796d59d4ccf44b5295b367ebfc272fe2988884e0f732d9adaeb24f7f771afc2bb9ca52f5280bbb0bca87c45d7e81be51b49cbb0c1
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfM:icVUcTedI6C9e9MQR7t+chW
TLSH
T1FB961821EADB91F5E8035C31115BB33F67311E048728DAE7EB543E17E87B6A21CBA605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_UIkNxmaI.exe

Path C:\Users\Admin\AppData\Roaming\MeasureDismount\agent_UIkNxmaI.exe
Size 7.0MB
SHA256 bef1ced955e4f14128ddff75b0b56e45af9ac5fa3501de60c3468960fec33cd6
MD5 9e8fb7b439a0f018d1b55f1da894083a
SHA1 bb16a15cba7f6ae671c70a24c19856aa280bf85f
SHA512 59ad4e87a33c95a4a7918406d25c54f290835764e88c8cf5476232883071a9ee68407002610f08c1e4fe0f63f71f7d7105cdc391f7b9884a9d0b8ed637ca14c0
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFft:icVUcTedI6C9e9MQR7t+cx
TLSH
T13F760620EEDB91F1EC035C31116BB33F67351E058728DAE7EB943E06E57B6A218B6605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_UIkNxmaI.exe

Path C:\Users\Admin\AppData\Roaming\MeasureDismount\agent_UIkNxmaI.exe
Size 7.6MB
SHA256 a63b95ffb5118fea18c20f92432f8dc124eb3647bd14478ef543f99d3c9a6961
MD5 6c5ede15623cfc8fa2a821368f1472f0
SHA1 cca4726745e4503f05231d77c88602247a9e6475
SHA512 3fed439fea6a30c7cf9f2c78e760336053668b4e71ca36adf707c2b317c86752db68c95769de8ad820a2355455bad93d900e35af766f9ee0e730c895400460b4
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfc:icVUcTedI6C9e9MQR7t+c4
TLSH
T1FD860721EADB91F5EC035C31116BB33F67351E048728DAE7EB543E07E47B6A218BA605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_uRMpSsLZ.exe

Path C:\Users\Admin\AppData\Roaming\Sun\agent_uRMpSsLZ.exe
Size 3.1MB
SHA256 c5a3acc824a4227637ebae6be993db0f1e64e40c1cb8109a83bae56d2cc4fcdd
MD5 65f66d83e5fdd24eefff79772e81e3ab
SHA1 e983634b96595d1bfc514a356f926eeab6a1855a
SHA512 852b5611171a8e730adbb26b4489fd4aec5f8a7e81404a2e3fdc2fd3692aec66aeae1fba00376f7c2b7a0a620e7403afbe9bc061d6d7b4e16a2acf1de407e437
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4k:icVUcTedI6C9e9Mt
TLSH
T12CE5C564EEDFC1F5FD435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_uRMpSsLZ.exe

Path C:\Users\Admin\AppData\Roaming\Sun\agent_uRMpSsLZ.exe
Size 3.3MB
SHA256 5f74b946aabb8bdfe5bad3947ecd65b586c01fa0640ea1190e55c5bf03b842e6
MD5 82655a1ec496da78073a6e4c455b0087
SHA1 cd4d4502c05ede3355a10c177e0599db6333fee8
SHA512 570a6a5ecc45a333e1b3646dbdd1086d30a7f8e21254f9d4db7798a0731619d16c34a1d2b633c9331e945530c45f6f424a8425ba9486aab157a5b735ec5f8ffe
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7J:icVUcTedI6C9e9Mu
TLSH
T10FF5D564EEEFD1F5FD035C30115BB23F6A3526098738DEEBDB901E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-9603-0x00007FFDAB550000-0x00007FFDAB852000-memory.dmp

Download

memory/3224-9607-0x00007FFDAB550000-0x00007FFDAB852000-memory.dmp

Download

memory/3224-9605-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3224-9604-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4540-9611-0x00000000052C0000-0x000000000590A000-memory.dmp

Download

memory/4540-9617-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/4540-9616-0x0000000005230000-0x0000000005296000-memory.dmp

Download

memory/4540-9615-0x0000000005190000-0x00000000051B2000-memory.dmp

Download

memory/4540-9620-0x0000000005B90000-0x0000000005EEB000-memory.dmp

Download

memory/4540-9621-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Download

memory/4540-9622-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/4540-9623-0x0000000006550000-0x0000000006598000-memory.dmp

Download

memory/4540-9624-0x00000000073C0000-0x00000000073F6000-memory.dmp

Download

memory/4540-9629-0x0000000007400000-0x0000000007420000-memory.dmp

Download

memory/4540-9630-0x0000000007420000-0x00000000074C3000-memory.dmp

Download

memory/4540-9610-0x0000000002740000-0x0000000002776000-memory.dmp

Download

memory/4540-9626-0x0000000070BC0000-0x0000000070F1B000-memory.dmp

Download

memory/4540-9625-0x00000000709C0000-0x0000000070A0C000-memory.dmp

Download

memory/4540-9632-0x0000000007560000-0x000000000757A000-memory.dmp

Download

memory/4540-9631-0x0000000007BA0000-0x000000000821C000-memory.dmp

Download

memory/4540-9633-0x00000000075C0000-0x00000000075CA000-memory.dmp

Download

memory/4540-9634-0x0000000007670000-0x0000000007706000-memory.dmp

Download

memory/4540-9635-0x0000000007A60000-0x0000000007A82000-memory.dmp

Download

memory/4540-9636-0x00000000087E0000-0x0000000008D9A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads