salatstealer | 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1

Analysis

max time kernel
35s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT5).bat
Size 2KB
Sample261030-afyvtstyfw
SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
TLSH
T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral25/files/0x000d00000001c68e-5663.dat	family_salatstealer

Executes dropped EXE 4 IoCs

pid	Process
4428	Setup-bTbvWlUQiXYpayRj.exe
812	agent_JnTrwxiZ.exe
2132	Setup-bTbvWlUQiXYpayRj.exe
5588	Setup-bTbvWlUQiXYpayRj.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2732	certutil.exe
3404	certutil.exe
5064	certutil.exe
5432	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3652	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_JnTrwxiZ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_JnTrwxiZ.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_JnTrwxiZ.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4036	3652	cmd.exe	89
PID 3652 wrote to memory of 2732	3652	cmd.exe	90
PID 3652 wrote to memory of 4428	3652	cmd.exe	91
PID 4428 wrote to memory of 812	4428	Setup-bTbvWlUQiXYpayRj.exe	92
PID 3652 wrote to memory of 3404	3652	cmd.exe	93
PID 3652 wrote to memory of 2132	3652	cmd.exe	94
PID 3652 wrote to memory of 5064	3652	cmd.exe	96
PID 3652 wrote to memory of 5588	3652	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT5).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4036
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\AppData\Roaming\Sun\agent_JnTrwxiZ.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_JnTrwxiZ.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:812
  - - C:\Program Files (x86)\Reference Assemblies\dwm.exe
      "C:\Program Files (x86)\Reference Assemblies\dwm.exe"
      4⤵
      PID:1544
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:5448
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:3344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe" -
        5⤵
        
        PID:260
    - - C:\Program Files\Google\Chrome\Application\dwm.exe
        
        "C:\Program Files\Google\Chrome\Application\dwm.exe" -
        5⤵
        
        PID:3612
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Users\Admin\AppData\Roaming\SplitUnprotect\agent_HhAtqbbO.exe
    C:\Users\Admin\AppData\Roaming\SplitUnprotect\agent_HhAtqbbO.exe
    3⤵
    PID:5972
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  PID:5588
- - C:\Users\Admin\AppData\Roaming\InstallDisable\agent_ogYsbwta.exe
    C:\Users\Admin\AppData\Roaming\InstallDisable\agent_ogYsbwta.exe
    3⤵
    PID:2796
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5432
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:2632
- - C:\Users\Admin\AppData\Roaming\UnblockInitialize\agent_dRlpKXQk.exe
    C:\Users\Admin\AppData\Roaming\UnblockInitialize\agent_dRlpKXQk.exe
    3⤵
    PID:236
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-l3=ipv4 --filter-tcp=80,443,2053,2083,2087,2096,8443 --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=14 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
Size 1.9MB
SHA256 812d3588f0df5b0250c77cac42a1615bb346f37373b6bad3b03f9443afaa2a09
MD5 9befd4698a7512b6eddf533438a8952b
SHA1 48960382dfdc3d67fbef8e9809e36371811aa8ff
SHA512 854a860c29e9a0db18cb8c70246c6fe6fd1301c74b07f427b18b3d9031e341ec0746c4391130aa0a5f356e2ea0a28cd0d3b2aa091d82c6546c611ed69938623c
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeV:TjycqCUjvnTGmp2TedLKtJ8CRV9V
TLSH
T1DE95A664EEEFC1F4ED435C30615BB23F6A3522098B38DEEBDB941D02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
Size 2.0MB
SHA256 e4c7b28b2389db8f476c13dc05e4d99e8b953f0580ede552be7742061312468e
MD5 dd79fae986198513327347d79cd0f158
SHA1 75599afdd62130a0b6a0df7490f44c64368912a6
SHA512 52f1434e01175320405b07b3d4ead416914935a7474e154b39beffd1662692b9fbce7a6ee413f0f2aea5eeef7f1d8f01daafa508b71fb23d300546e0ea3a800f
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVer:TjycqCUjvnTGmp2TedLKtJ8CRV9r
TLSH
T13EA5B664EEEFC1F5ED435C30115BB23F6A3522098B38DEEBDB941E02E55B6A21877205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm.exe

Path C:\Program Files (x86)\Reference Assemblies\dwm.exe
Size 4.4MB
SHA256 32303102a55dd5136a9ac9a6f144abdd024e44f1782f8073e045b6352e4f19af
MD5 dbdb073c1bbf4a64f24fd47948e18800
SHA1 c60d40bfec92d140fbe502f7d497196044e2b21c
SHA512 aac4010841f8082035584ee792fe8882f1f2738d785877ad29c0ca206e07aa0cbf2a474782c11b0296ef72a002cd8b70bd0596a4c082d5cfc4de95d198392eae
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXht:icVUcTedI6C9e9MQR7tz
TLSH
T1A426D664EEEBD1F5FD035C30215BB23F6A3516098738DEDBDB901E02E56B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm.exe

Path C:\Program Files (x86)\Reference Assemblies\dwm.exe
Size 4.1MB
SHA256 27816e029d5d6c6b9db11241a3cbf175bba9f48e57d61fa3374817af260ecbec
MD5 a7e9371c112f2ffe1c984dfe83ff31db
SHA1 1326ee9ba1dea345ff4e4e0abe9e8fa0ffacc752
SHA512 6fd9678f26fd96e344b3ff98608643194cf200e712ee778fbf983e6656c7ed97a7bc5dce3e559488b5f065bf670891584612d6c1d783c4368841e513bb63b826
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272Ig:icVUcTedI6C9e9MQR7tg
TLSH
T16316D664EEEBC1F5FD035C70215BB23F6A3516098738DEDBDB901E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm.exe

Path C:\Program Files\Google\Chrome\Application\dwm.exe
Size 2.4MB
SHA256 a09fc17c5a72670ef629820244147873b7754912ac8e1e4060a2fec033ebefac
MD5 01f7d0f0c3d1b2d390e182c6fdb474f8
SHA1 c6b8333a970524ea97bbe37337467aa3b3d37408
SHA512 624fab2f5c457e7ec3902e685df7cc1dbcf4be0c5996a9dfcd1e9a2eeb1f1f2ae1c518f3052319ac8c0e24fef116220d49f30f80f7687090436eb06311a6a620
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR8:icVUcTedI6C9e98
TLSH
T10EC5B564EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm.exe

Path C:\Program Files\Google\Chrome\Application\dwm.exe
Size 2.6MB
SHA256 9a260379c0d5f58430d4745997836216127c7ef32c2c5a81e1da4eac9bd5a8b4
MD5 d359aa42717056df34c9907ba210cb6c
SHA1 5c3d2bb5fe2b7d155a96616ae69a71ab45e4c036
SHA512 e5916d4b0800edff1012815eee16894d2391450bd60a29dea895b806a029dfcbccc0a8fa3d4db37fabcfc3854cf84adb2b34f8258794c5b264500e14f7e2264c
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR/:icVUcTedI6C9e9/
TLSH
T158C5C660EEEFC1F5ED435C30115BB23F6B3526098738DEEBDB941E02E55B6A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 5.5MB
SHA256 9239d705b508883c5f14fbb966492f5fe75dd9bc7421bcd63a3088d2a0cd5d51
MD5 0192ff425af747e1fd44109d22d8dd85
SHA1 006b625db7a0f565809ebdd75cf36591bdc4dfd0
SHA512 28138f33e7b79c28967a20c7b15da02c6a9987d14abe08443ae63dd6149707f63c6d15e775fb9e1a03413f59d48170715ec66a3101281de927af34d1145e8785
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eNX81:06GtcbPy/lwHVSavaeNM
TLSH
T135465B13EC6555E8C1AED2318A729163BF617C880F3163D32B90F6292F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 976KB
SHA256 a6de12b3f166cd661e66dff1c104cb49242f415dd0280c63cebc72a954407b26
MD5 e4025ec8ccb213d78b9d65b967ffe60d
SHA1 7ffbdfb4ca8709fa2f83d3e3ec8db82b5b938f46
SHA512 e773d66402ae2fb48d917ad5bc2c00e0909386a09553b63507923fe704ebcf88d84d9768531b2a554985ebe1e87bfcf532390b9485002455e2661e71fc1dc59b
SSDEEP 12288:Wt8AHp7B9K6k17Fhv/XS7eONrpoIn8rl9avwWne4dYjrDMj8C2Bfqdw0J/NF0rK:Wt8oz5NXn0lA5rd6K
TLSH
T14E25393606A774BC35BC3D4665120D4D6E9D3B0E157E430677C930BEA3AE8E88E19E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 12.3MB
SHA256 6ddfe0642e7f3b8ae8d0893682f6634b1f9cf761d6e001b2e49445a70a86dbc6
MD5 30c5dcdf5c921c92e4d4c5c8e3c1b31b
SHA1 ef84b1d496506912dc6dc1afc792386a13fa2e84
SHA512 cd6781cad5b7b687fa4d7a007ce2a4eb307f174d602e16c5fbd49282f3ab04dca3d5685d94d1dd3e75f2cdbc7810a1283d1d45a6f01943607a6c300631bf4bec
SSDEEP 49152:WB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKps:0
TLSH
T17ED6CF720243FDFD2F691D45E0043E815C9D7A5B22A8D299FF8D30BA62EA564DE3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 24KB
SHA256 7052b98ce1e9328ae5a90113607d7d0bb9d1b647fb26df83510c0ae5a915654e
MD5 a6a9a4be2c0f2a1fecb909890d923f91
SHA1 bbb01ef7177bc3a37f3e152f903dcb72aeafccfd
SHA512 c14998f3cf9c755fa762834b46a27632c8be8ac11db572eb191be55703ac2f4f61f183ea35b82c91fcb18a7709bd92feb7a207133ec0aab43a92c1b7d77290f3
SSDEEP 384:Sh4Uv2qhKDRod94TN3FURa1BG1TLRYv9EBC43bIjbn8lTxGLL37w3:Yx2oT4h3OR2BoLRSb4Ujbn8lT8Xm
TLSH
T1AAB2D535425FB5B9387C398165431E1C2D8E3607236B978672CA707E87EE8E18E19F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 3.9MB
SHA256 e2dc2fbdc5a0498123591297b3ab15b1c3d47d25cd1188ad97eb687dad054207
MD5 37389e581f2681d1e3c7e423a11939e2
SHA1 9264b24017c811e9ca5c74fbed9436cc5c168a4b
SHA512 e5e33d9715b6713aa970baa3e2045c9e2dbdbcdb0b835a0ee3ede0dc89bcd1d5bdcd5dc997c5a5601500619d0dadd8689d663c941d0fbadfa26301b88921c8b6
SSDEEP 24576:nJt8oz5NXn0lA5rd6N1vJvKzEMZeuDl68e3d5PbqXkDfQQKiRiTJ9qlS+CRPhwgg:nJB5N304rSRCBe3rVBNRoz/YJKje
TLSH
T181166B360243FDBC3FAD6D86E4052E455D4D760B21A4839ABB4D34BE63AE5B48D38D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_t4ly0kev.0ja.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t4ly0kev.0ja.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_ogYsbwta.exe

Path C:\Users\Admin\AppData\Roaming\InstallDisable\agent_ogYsbwta.exe
Size 4.6MB
SHA256 5fbeb57fd2f10e3529bc708ca835ce44116144321e41063e85379ee0344e0433
MD5 f8b45ec4d1bee030d0e0988415e3f25e
SHA1 ca0674bb41b5fd1c59022b4cd12db38fd641381d
SHA512 3535790035e77abbc9c3d27ba2b83ce29fe6086a7cd29afab0e58411afce17dd458b9eb2626b38c7f5c2acd5c40dd8bd61c3d1d7ae528508a9b50d6b071bdc37
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV9:icVUcTedI6C9e9MQR7t9
TLSH
T17D26F664EEEBD1F5FD035C30215BB23F6A3516098738DEEBDB901E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ogYsbwta.exe

Path C:\Users\Admin\AppData\Roaming\InstallDisable\agent_ogYsbwta.exe
Size 4.7MB
SHA256 8ff9e1fe04d3bbcc3d13cc4f15053380fdd674057b86ef30c955b76b5fa1ab44
MD5 cd80fab757d30f6a364ea228c81e5819
SHA1 e67a36df36e9f05648c704ad2a4ba863054d9dbf
SHA512 b473eca9f815a436aee59e28503893c5d1454d70e85e99731f8a8358d85e17c0b7269d73207ab609d70e5e7c56215cd2a4bc0da4e6b325d9109a26711c1289ab
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IvXhV+K:icVUcTedI6C9e9MQR7t+K
TLSH
T12436E764EEEBD1F5FD035C30215BB23F6A3516098738DEEBDB901E02E15B7A21876606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_JnTrwxiZ.exe

Path C:\Users\Admin\AppData\Roaming\Sun\agent_JnTrwxiZ.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_dRlpKXQk.exe

Path C:\Users\Admin\AppData\Roaming\UnblockInitialize\agent_dRlpKXQk.exe
Size 2.8MB
SHA256 c85cea7570391c488329d259ee1c35c44777b8a3a8f97539eeb7012062b6a101
MD5 2cda78cc0a4bdef6ab77eac6bb43a383
SHA1 d855f4160cee2822f7e39cedfa433e6c78072870
SHA512 ae70b1d9ac209b8fee659c83cb30f05f0c6a48362b4a4112afdd1e89d2b11c5290d59e63c492b27c207ed725546aaa25be173b9b68142e385cd0eb0e06b65325
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIf:icVUcTedI6C9e9F
TLSH
T1E7D5C664EEDFC1F5ED435C30116BB23F6A3526098738DEEBDB901E02E55B6A21876306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_dRlpKXQk.exe

Path C:\Users\Admin\AppData\Roaming\UnblockInitialize\agent_dRlpKXQk.exe
Size 3.2MB
SHA256 03e8cd5e64a69171c3c9becbebac981d8a8fd2598f45e250143fd90fbcfd04e9
MD5 17a2d8746f1818d8454571d37290e330
SHA1 c4b4d50ba57d01b8f9b922f7a44081997b66777b
SHA512 28fac6692ce0ecd3d5d2d825fd2c3781b6386f6bc69d6181742dee15d11d39ef526b6d148af186572f440ad9aca6ba5775aa7a531b4cd667bd63c73d63fc3304
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7S:icVUcTedI6C9e9MZ
TLSH
T1F5F5D564EEEFD1F5ED035C30115BB23F6A3526098738DEEBDB901E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-14031-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1672-14034-0x00007FF84C560000-0x00007FF84C862000-memory.dmp

Download

memory/1672-14032-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/1672-14028-0x00007FF84C560000-0x00007FF84C862000-memory.dmp

Download

memory/5448-14048-0x0000000006180000-0x00000000061E6000-memory.dmp

Download

memory/5448-14053-0x00000000061F0000-0x000000000654B000-memory.dmp

Download

memory/5448-14047-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/5448-14055-0x0000000006700000-0x000000000671E000-memory.dmp

Download

memory/5448-14056-0x0000000006760000-0x00000000067AC000-memory.dmp

Download

memory/5448-14046-0x0000000005920000-0x0000000005942000-memory.dmp

Download

memory/5448-14062-0x0000000006CA0000-0x0000000006CE8000-memory.dmp

Download

memory/5448-14045-0x0000000005AC0000-0x000000000610A000-memory.dmp

Download

memory/5448-14063-0x0000000007B20000-0x0000000007B56000-memory.dmp

Download

memory/5448-14068-0x0000000007B60000-0x0000000007B80000-memory.dmp

Download

memory/5448-14069-0x0000000007B80000-0x0000000007C23000-memory.dmp

Download

memory/5448-14044-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

Download

memory/5448-14071-0x0000000007CD0000-0x0000000007CEA000-memory.dmp

Download

memory/5448-14070-0x0000000008310000-0x000000000898C000-memory.dmp

Download

memory/5448-14072-0x0000000007D30000-0x0000000007D3A000-memory.dmp

Download

memory/5448-14065-0x0000000070500000-0x000000007085B000-memory.dmp

Download

memory/5448-14073-0x0000000007DE0000-0x0000000007E76000-memory.dmp

Download

memory/5448-14064-0x00000000702B0000-0x00000000702FC000-memory.dmp

Download

memory/5448-14074-0x00000000081E0000-0x0000000008202000-memory.dmp

Download

memory/5448-14075-0x0000000008F50000-0x000000000950A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads