salatstealer | feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d

Analysis

max time kernel
2s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT4).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
MD5 1a9353401fc545311572880d32a88f78
SHA1 9e005a4a276e9b93f0499bdea7aeae070048d31e
SHA512 86b79c6aa9cda652549cfce001c82eda023e32ddecfdd33d11decbb5afbe9b24fc5eafa5673fa1019a4caddd9ff32855cc6b78753769283f2ad96ebf0d8d44c5
TLSH
T1EE715A93E00CDE42F6CDA53EF86FA6A421279CC318D6D452439B89F8DC0ECBD584E594
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 11 IoCs

resource	yara_rule
behavioral23/files/0x000c00000001c58d-3841.dat	family_salatstealer
behavioral23/files/0x000c00000001c58d-3840.dat	family_salatstealer
behavioral23/files/0x000c00000001c58e-3846.dat	family_salatstealer
behavioral23/files/0x000c00000001c58e-3844.dat	family_salatstealer
behavioral23/files/0x000c00000001c58f-3856.dat	family_salatstealer
behavioral23/files/0x000c00000001c58f-3855.dat	family_salatstealer
behavioral23/files/0x000c00000001c592-3860.dat	family_salatstealer
behavioral23/files/0x000c00000001c598-3868.dat	family_salatstealer
behavioral23/files/0x000c00000001c598-3867.dat	family_salatstealer
behavioral23/files/0x000400000001a305-3882.dat	family_salatstealer
behavioral23/files/0x000400000001a305-3883.dat	family_salatstealer

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
6112	certutil.exe
5940	certutil.exe
3512	certutil.exe
5544	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4256	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3144	4256	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT4).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3144
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5544
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:5820
- - C:\Users\Admin\AppData\Roaming\AssertWait\agent_VmfehBnD.exe
    C:\Users\Admin\AppData\Roaming\AssertWait\agent_VmfehBnD.exe
    3⤵
    PID:4848
  - - C:\Users\Admin\AppData\Local\Mozilla\lsass.exe
      C:\Users\Admin\AppData\Local\Mozilla\lsass.exe
      4⤵
      PID:1280
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:5212
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:1396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -
        5⤵
        
        PID:1052
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:6112
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:6072
- - C:\Users\Admin\AppData\Roaming\RegisterRead\agent_kKhMPUBg.exe
    C:\Users\Admin\AppData\Roaming\RegisterRead\agent_kKhMPUBg.exe
    3⤵
    PID:4392
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5940
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:1256
- - C:\Users\Admin\AppData\Roaming\RegisterRead\agent_BiMLaQDt.exe
    C:\Users\Admin\AppData\Roaming\RegisterRead\agent_BiMLaQDt.exe
    3⤵
    PID:4744
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2324
- - C:\Users\Admin\AppData\Roaming\ConnectConvertTo\agent_XCjuzjYQ.exe
    C:\Users\Admin\AppData\Roaming\ConnectConvertTo\agent_XCjuzjYQ.exe
    3⤵
    PID:3136
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
Size 9.8MB
SHA256 646376539eb29366edd6eab12b9ce18a9466732c4ab33a67fbb6c7afab77e1c9
MD5 9f2afd11e90d3b4297cf9502cca43b77
SHA1 b544370973f15ed93895a8187f6dcedf853cbf42
SHA512 57bd88ef2c5fcfe7e866bcf3e883cbc3da47f600cf981ef7e5beb79b3582d42fc64ba6e08bb338c71f2d99ef95689c06e731b64c92217c540ed8193df5219151
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfl:icVUcTedI6C9e9MQR7t+chQa4k
TLSH
T1DAA63921EADB91F6ED035C31116BB23F27315D048728DBEBEB543A16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
Size 9.8MB
SHA256 3a7c0193fca96c4667902f0bb919c0522e805055384b223a35939d10d0896cf8
MD5 e21586ff3e869d65c273454792f03de2
SHA1 9f54da2c60eba49349ae5fc00b3a0129d48e43ab
SHA512 6142217a0e3385d61b1e3b42ba2611212fb48dc5067c6727a7fb941100c8fe99b900dd88c561c34beb964b0ea0df019fe9ba8940e57cc9cbb6755f85fb398ecc
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFf3:icVUcTedI6C9e9MQR7t+chQa4G
TLSH
T129A63921EADB91F6ED035C31116BB23F27315D048728DBEBEB543A16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\AppData\Local\Mozilla\lsass.exe
Size 10.0MB
SHA256 3281e8f95af1c675aab2799dadca7cd18fac87e9fe00f9fbe94ce85a3dc881f1
MD5 74eff5ee9dfa7141a99dbd9a11c5ad19
SHA1 49f06513a62dcc5bf45698d77ae59fe0276edac8
SHA512 16dea70658a74c8f7409146a0ad576c06c73ac3c00ee4d0c5853b77158e5dbf5148e282faa438a92e693fa4a5ab3d6e71a3c1974944c4c95c36358d59c0c09db
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfY:icVUcTedI6C9e9MQR7t+chQa4R
TLSH
T126B63921EADB91F6ED035831116BB23F27315D048728DBEBEB543E16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Users\Admin\AppData\Local\Mozilla\lsass.exe
Size 10.7MB
SHA256 bdecbbb9c9ecbd68e5b9e71ce2bc3c7bfd20b7aa14fd87c7b403da402ff18e8c
MD5 893c4b7ac7197dd9dce0e78fe988f8bf
SHA1 eb2772e3911134882c18abb2b650131f6a7040d2
SHA512 8cd7405f37cbdced9ab574fc984367421955ab266f36cafd4df214b69272b61ef0da9f55ff28f5bc3434e12048c7a3df921d0e31a76ad4626c9341be3c53429a
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfg:icVUcTedI6C9e9MQR7t+chQa4NG2r
TLSH
T166B64911EADB95F6E9035831016BB23F27305D048728DBDBEB547E2AF87B6921C7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 10.6MB
SHA256 5dffff4b10792a1fc69148423845f2e3a325c6e2067678c706d8be872b179f9b
MD5 84985da2bade4d8590bb2c250cc353f9
SHA1 c83279beaa188d9baa45a56c39b88cfa0ddc36ec
SHA512 8a24175d7eb5bd8992e081355c429ae70c5362790324748b06c0719b7537cd0a73e7a813ba8208d7e357f93f6103fd54eeacadb3ae3f2ce853c99af1ad08edd3
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvE:0bsPPSavMjysmCV3IhGjkJPnvgaQIvE
TLSH
T1A0B6BF03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 10.2MB
SHA256 bc4aae87e53a3802533f1cbcee7f86f44b1ee83c91fda3b670e12167efacb3c9
MD5 aa4dcb9e3b925ce58be627eea05b030c
SHA1 7f8bdd40b6095a8363571f459a708a0fde8f4c46
SHA512 fd583bbe83a0b6b939bb4fc17d4c0b8382b135a9b8f37eb295e06d94569e7bf82f5d63b66b26db00585668e944a05c0520c1013ca465b0352a8ccf9db39b8712
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hs:0bsPPSavMjysmCV3IhGjkJPnvgaQIs
TLSH
T1F1B6BE03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 10.1MB
SHA256 a6088922ed201b33cf9699b3acc8973a4e61a4d068257cf36466898088e46a8b
MD5 3c41ae68e734f50f68bfc454a42e9736
SHA1 4e176edb2f52c8aac1c157ba391b253e78ad7d35
SHA512 2d615bcc7243e684a5f1ec05d4105dda23e19347a9781c81c1ac9f945ecd3feb3603f4f82e16abc26e2d2165d2fa13c63eb568f845474b3b17e1905e0cbc6ab2
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgai:0bsPPSavMjysmCV3IhGjkJPnvgai
TLSH
T1DDB6BE03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 10.5MB
SHA256 15e0c7fb880ae226dc674fd156f318ea119396b2e9a15890582395a0278fafbe
MD5 0eccc06479746e7fcb6fc103fa9709cb
SHA1 c0bb85b8983f7c58e2c9fd2aa5ec63ccc115a756
SHA512 ba908f0160c86a5a05a0498c56cf49d0c37e8ca9efe5a06c5ee98241e69cf9383bc4735edb9b400341a2c22ce7191adee4bff01993b2f090b2e56c1b0a53de99
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvq:0bsPPSavMjysmCV3IhGjkJPnvgaQIvq
TLSH
T1F9B6BF03EC5559E9C0AED2718A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 98da91450c15ca2772e113c168b8c5667b4545b912503a5bb099d29f823acc47
MD5 b980045e76c4cf67e3e213204e22eba3
SHA1 0a595623d81bf8a223c19941a1100fe0350347c2
SHA512 8e1bd62cebf0cf1328aa84572d617725654ebca5885a1c81acea4b9d28353e8d6bacbb4bdd3a55daf44ef18066b66d6c2d7517e170f1610d1972e8cb31abc49e
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmalEDhQjl1vsli:SJH9XuutQyGMNroE3O8tHEi/maleqUli
TLSH
T12A926D744AE33CFD3E8C7C5061201DAC5EAC6F8754694209ABC838F693D85ACCE5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 11.4MB
SHA256 5ed37deba911a4e26e84e8623f911938252faf453cb5bd2f83c7230902c4df61
MD5 32e6d4be1d697c00d42772b7731554ff
SHA1 779f8079ce971d398b32d5b98430c4d5aa048200
SHA512 cd3a1f2933be13dc50bb09eff3f5477eea3d07a736eb0a0e35b3ba2ce7bc70348c9b39ced5c60bf20824c474018c6c5de50c9a84fd9f329843d63d5afeaf89b4
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjct:G
TLSH
T1ECC69D320693BCFD3FAC3D45A0012E495D5D7A0B11A9935ABB8930BA63ED5A4CE3CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i4r5hmxe.wby.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i4r5hmxe.wby.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_VmfehBnD.exe

Path C:\Users\Admin\AppData\Roaming\AssertWait\agent_VmfehBnD.exe
Size 10.7MB
SHA256 bb51bd9cc4d118bef0aaa1f4bcb4e4536c9c8adb9f615bf20522c30c458d1cdf
MD5 0abda5ee4884690ba52a9c2fca1cc4d3
SHA1 78732518d3d5176c7de5b1bdad84b99fa0340e36
SHA512 c4628e8d40f16d2daeedf578ba6613a581240176c00b3b0ec258862d365c02b4c2b3accc35c17bc619c31119770af00520599f56224ecd491849403fb89b83ee
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfB:icVUcTedI6C9e9MQR7t+chQa4NG2
TLSH
T166B64921EADB91F6E9035831416BB23F27305D048728DBDBEB547E26F87B6921C7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_VmfehBnD.exe

Path C:\Users\Admin\AppData\Roaming\AssertWait\agent_VmfehBnD.exe
Size 11.3MB
SHA256 479d2ae9cdb9505db80ad05342210ed1fcdd62136da9f422b30cd227dc452c56
MD5 feb9f5e2ec9596e48b5a97e2d5afebb7
SHA1 0a345842c160b0015822dc0f91d9ed18803a018a
SHA512 ea7d18a48e2d02660dd660c6f818615a7eb01861e13a209c527c77d94e809e8b34f50b92870fd7a895c6df5d6187197cd005767b310a7f44054c231086e19e31
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfE:icVUcTedI6C9e9MQR7t+chQa4NG20CT
TLSH
T131C65A10FEDB95F2E9035831416BB27F27315D048B28DB9BEB547A2AF87B6911C7A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_XCjuzjYQ.exe

Path C:\Users\Admin\AppData\Roaming\ConnectConvertTo\agent_XCjuzjYQ.exe
Size 11.2MB
SHA256 659ff8150d8502f7ddb4cf11fdd12bda7f29de8d8a059bd76bf9c820b03c6bc3
MD5 56b4d35b48acd3ddfeb9d96f3ed4564a
SHA1 902828020bdab05b69be6573e64823fed317c85e
SHA512 ec8b07208906182f7c8c66fb2ce7bcb9b866a83526d170f5e17d0e46e0797957867cdd4e85f8ed60a644346ac1bddc5cc108f1bb578bf3bf63e325a8fc7e1808
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfQ:icVUcTedI6C9e9MQR7t+chQa4NG20M
TLSH
T1DBC65A10FEDB95F2E9035831416BB27F27305D048B28DB9BEB547A2AF87B6A11C76305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_BiMLaQDt.exe

Path C:\Users\Admin\AppData\Roaming\RegisterRead\agent_BiMLaQDt.exe
Size 10.0MB
SHA256 834960245e544e5b41529f417369a81c2686275cb8ba0cdba873eaaa23fe46f2
MD5 7bace3ed90613aec09d5a36c15abf917
SHA1 3e48e665dd3b6400c14448a50deed6e4893be66b
SHA512 0260b6fa26a64dda08a3ae484bd1b935125c49226c63e33e4a0e5bec9a25c78269706de44d8c74abdbd390f95abe8c3dd0754f12923857171307227d740fec3f
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfl:icVUcTedI6C9e9MQR7t+chQa4U
TLSH
T19DB63921EADB91F6ED035831116BB23F27315D048728DBEBEB543E16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_BiMLaQDt.exe

Path C:\Users\Admin\AppData\Roaming\RegisterRead\agent_BiMLaQDt.exe
Size 11.9MB
SHA256 078543f88641d90fdd5a4926da870484457625130000c8e2a1d9b945caa53f68
MD5 059ded197e89f602a91f4fcbb443b592
SHA1 bdbd11991fd130d885e4854f2accc6c5b2c31b8d
SHA512 8b587720c4f0db6cf803a18d6a9c978112f8f86d4d025eb3400e6eb4f0d00f01b52219fb75542912aead2b68e2888107e11bb1e9d55248842a0b1093e23e583e
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEEv:Ac9ZeuQt+IJnAEv
TLSH
T10AC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_kKhMPUBg.exe

Path C:\Users\Admin\AppData\Roaming\RegisterRead\agent_kKhMPUBg.exe
Size 10.9MB
SHA256 b434830b4fcf16d1daa183e26b7566d5f7fb978ccf435783600c6ebda7bf9aa8
MD5 a3b7e60a66497011a1a6b77d8337d6bc
SHA1 341c0545a03df977a21907267d6df46af4f57351
SHA512 10e0ce799fd8ac74ad9f92dc961f0931687b78cd18ca275db112e2dd8a7b7d4d8d1ef51e259d05de07a93959d2c23721465ae1bf6c82c8b19e922d7b36e5b93c
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfU:icVUcTedI6C9e9MQR7t+chQa4NG2X
TLSH
T126C64A11FEDB95F2E9035831416BB23F27305D048728DB9BEB547A2AF87B6921C7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_kKhMPUBg.exe

Path C:\Users\Admin\AppData\Roaming\RegisterRead\agent_kKhMPUBg.exe
Size 8.6MB
SHA256 ac8ab8d7f7c0d8bab306bf88d47fbda941736aee8cdc8d60606e045f39d37a27
MD5 9c302aa750dea01065c78b18b4710197
SHA1 d798adef92ade7eca963a6dfe88405c2e075c99f
SHA512 1d49c277689f8f48bb2f8c5671b52534fa66e30fc3eb421e67f413d8519d7abd152f8a3293d9890d8404dd6fe345abd7c72c10873d78f329e36ac24bb91bdb97
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfQ:icVUcTedI6C9e9MQR7t+chG
TLSH
T14F961821EADB91F5E8035C31116BB23F67315E048728DBE7EB543E17E87B6A21C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_kKhMPUBg.exe

Path C:\Users\Admin\AppData\Roaming\RegisterRead\agent_kKhMPUBg.exe
Size 10.0MB
SHA256 24f718f605ff94e0cd2f8ad7822243bad2829688663ea0143adde2d3df3d9c6c
MD5 b5d9236e82169d6edeaaac3ee11bc5c2
SHA1 1565e6085ac2d63bcee29d0bc6caaa9f618bd742
SHA512 1acf38e3803c7ed3c2b5010e7b20dd9e7b88440d5787943fac32d857c03d5a2c0bf0c3f983f65c2b525ecd77c6dc4b144efa2a1db887337bb8708720741f27af
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+pSOgbBBFfr:icVUcTedI6C9e9MQR7t+chQa4u
TLSH
T197B63921EADB91F6ED035831116BB23F27315D048728DBEBEB543E16F87B6921C7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-3849-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2556-3850-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2556-3852-0x00007FFF8C9B0000-0x00007FFF8CCB2000-memory.dmp

Download

memory/2556-3848-0x00007FFF8C9B0000-0x00007FFF8CCB2000-memory.dmp

Download

memory/5212-3870-0x00000000052C0000-0x000000000590A000-memory.dmp

Download

memory/5212-3872-0x00000000051E0000-0x0000000005246000-memory.dmp

Download

memory/5212-3876-0x0000000005AD0000-0x0000000005E2B000-memory.dmp

Download

memory/5212-3879-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Download

memory/5212-3880-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/5212-3873-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/5212-3871-0x0000000005140000-0x0000000005162000-memory.dmp

Download

memory/5212-3884-0x0000000006F00000-0x0000000006F48000-memory.dmp

Download

memory/5212-3887-0x00000000705A0000-0x00000000708FB000-memory.dmp

Download

memory/5212-3891-0x00000000073A0000-0x0000000007443000-memory.dmp

Download

memory/5212-3890-0x0000000007380000-0x00000000073A0000-memory.dmp

Download

memory/5212-3869-0x00000000026D0000-0x0000000002706000-memory.dmp

Download

memory/5212-3886-0x0000000070370000-0x00000000703BC000-memory.dmp

Download

memory/5212-3893-0x00000000074E0000-0x00000000074FA000-memory.dmp

Download

memory/5212-3892-0x0000000007B30000-0x00000000081AC000-memory.dmp

Download

memory/5212-3894-0x0000000007540000-0x000000000754A000-memory.dmp

Download

memory/5212-3885-0x0000000007340000-0x0000000007376000-memory.dmp

Download

memory/5212-3895-0x00000000075F0000-0x0000000007686000-memory.dmp

Download

memory/5212-3896-0x00000000079E0000-0x0000000007A02000-memory.dmp

Download

memory/5212-3897-0x0000000008770000-0x0000000008D2A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads