salatstealer | 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f

Analysis

max time kernel
35s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general (ALT7).bat
Size 3KB
Sample261030-afyvtstyfw
SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
MD5 a8efa3ed6068b339fd86951c80e84c2f
SHA1 19b7620ecab1c14492f9576defcecadb6589edf5
SHA512 3aba9edd1a5369486b647d60c003bf098d9d45decc76c9a251543934e5ceaae3966c52d6af562a6c733177212d7c5e32534dcd8207d1e1975a8cadaacf3f3f8d
TLSH
T1CD513793F00DDE46B68EA83EFC9AA5F52017C8C35CD6D462539789E8C84EDBE4D4E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 2 IoCs

resource	yara_rule
behavioral29/files/0x000e00000001c513-5744.dat	family_salatstealer
behavioral29/files/0x000e00000001c515-9548.dat	family_salatstealer

Executes dropped EXE 4 IoCs

pid	Process
5968	Setup-bTbvWlUQiXYpayRj.exe
4744	agent_ipwDeIUO.exe
4896	Setup-bTbvWlUQiXYpayRj.exe
4380	agent_BTSxasQd.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2876	certutil.exe
2472	certutil.exe
4168	certutil.exe
4108	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5128	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent_ipwDeIUO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_BTSxasQd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	agent_ipwDeIUO.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_ipwDeIUO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_BTSxasQd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 1364	5128	cmd.exe	90
PID 5128 wrote to memory of 4108	5128	cmd.exe	91
PID 5128 wrote to memory of 5968	5128	cmd.exe	92
PID 5968 wrote to memory of 4744	5968	Setup-bTbvWlUQiXYpayRj.exe	93
PID 5128 wrote to memory of 2876	5128	cmd.exe	94
PID 5128 wrote to memory of 4896	5128	cmd.exe	95
PID 4896 wrote to memory of 4380	4896	Setup-bTbvWlUQiXYpayRj.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT7).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1364
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Users\Admin\AppData\Roaming\InitializeUse\agent_ipwDeIUO.exe
    C:\Users\Admin\AppData\Roaming\InitializeUse\agent_ipwDeIUO.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\Program Files (x86)\Windows Defender\ShellHost.exe
      "C:\Program Files (x86)\Windows Defender\ShellHost.exe"
      4⤵
      PID:3572
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        
        PID:2908
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        
        PID:1688
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Roaming\ClearUnregister\agent_BTSxasQd.exe
    C:\Users\Admin\AppData\Roaming\ClearUnregister\agent_BTSxasQd.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4380
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:4664
- - C:\Users\Admin\AppData\Roaming\FormatPush\agent_oEHGHWiT.exe
    C:\Users\Admin\AppData\Roaming\FormatPush\agent_oEHGHWiT.exe
    3⤵
    PID:6076
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe"
  2⤵
  PID:5676
- - C:\Users\Admin\AppData\Roaming\UseResize\agent_hzxngmzI.exe
    C:\Users\Admin\AppData\Roaming\UseResize\agent_hzxngmzI.exe
    3⤵
    PID:6052
- C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=syndata --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=syndata --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  PID:5412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShellHost.exe

Path C:\Program Files (x86)\Windows Defender\ShellHost.exe
Size 4.1MB
SHA256 6fa3b093152ae596e326e96a67072d45ceb1d0e6c8a3b8aba0da109bbdfe17ee
MD5 e54039c390b6e9ff280311bb5c184e5c
SHA1 32f75a80104541b29d6558cf8e611ba42d623a67
SHA512 1f0b6b5a4d3b3f194b2a4e156dd25ea669627927ffac436caf6897e5e11471a1733e6b664ccaf2da515979bf4d1b316fe24d856052a80e80b885535fe2214f5c
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272IM:icVUcTedI6C9e9MQR7tM
TLSH
T12016D664EEEBC1F5FD035C70215BB23F6A3516098738DEDBDB901E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellHost.exe

Path C:\Program Files (x86)\Windows Defender\ShellHost.exe
Size 3.5MB
SHA256 c42efc5041b88c8f6bab797702091e24c4a663a0b1ded9e99f4176f110d8bb59
MD5 cbd2af18df63cfe5d5ea007cc919c3d0
SHA1 6789d7c6d852f04f88f913183dda37303957c8ed
SHA512 12e82b3be578e8dd650938ca7ded4dca21b8441d464f3e896ee0ac699b214505c6769f2991da122aea41336952d8ade8f6ba842d841dc6c7771dd1035aa850e2
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd72:icVUcTedI6C9e9Md
TLSH
T196F5C564EEEFC1F5ED035C30115BB23F6A3526098738DEEBDB941E02E55B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 6.0MB
SHA256 4c592e77c7c31b523016d4a71ad92d0f87d5709d66b7daa5bea83ea776a6fd60
MD5 916d9f83015e204ca8c73615f6d629d9
SHA1 329189c78d4a99cc339766948fc1e381527e5689
SHA512 6b3afed0995ecd4be62deb6f67b2b0048d615d9004a6ea51c2cbb4c45f766d47148c2fa85e98a06fa3d4e90e2fcafb162c30a215929618d89449854698efbb28
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViaFSw8vpKQK1K6eNX8C:06GtcbPy/lwHVSavaeNn
TLSH
T193565B03EC5555E9C0AED2318A729263BB717C881B3163D32B90F2396F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 3.3MB
SHA256 39508bec76299a1f0c9155eb4f6e430c311a421494f2fa2a17c613014c8b5e0c
MD5 bd996af2ea32ec492e55a2479b69d23f
SHA1 73a833f0dd87283fffec4b024404b6be7fc91e7d
SHA512 832fd538fc43e25a39b28d7c8efb114f0daa45a43c58cac23afa0a4a450674f3698e2b6215788b783f3fada6fe4738580ac2b16d2e804ad1f675a10cf81a1be7
SSDEEP 49152:06CrtFly/bnPr18ttnAbNkrVv2Ig9zhtpiqawH6Ir7JSViT:06GtcbPy/lwHVSg
TLSH
T14DF5F817E8A950E8C0FEC575C763E623BEA13849433433D36FA196211F56FE0A9B9718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.exe
Size 11.2MB
SHA256 e92a0dba7fbf23ded7f4684903a04a2a628a2e38db93ba5cd7e4366a6ed30540
MD5 2047b3e84f17a1cc219a4332b2b3394c
SHA1 2b6efb69fb6c22cc49479a5bc77830d54e9dfc15
SHA512 7faa52a92b534a215c9d02b5251a1c13a2ad4ce2e36a396ed52cc062b9d4cb42a37a8062656324969aa907b688f2ab17133aef5edd3d40601c02dae6da75b3db
SSDEEP 98304:06GtcbPy/lwHVSavaeNn6dJJQs6t505PZK+T0KZRIXxGjkJPUuxwdZAgaQN98hvh:0bsPPSavMjysmCV3IhGjkJPnvgaQIv9P
TLSH
T13EC6BF03EC5959E9C0AED2718A729122BB717C884B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 28KB
SHA256 492eb06b59c0be54c0e7d1c93d4b9c75d6521d77e4bc628003a6ffcea11856f2
MD5 134fcd554c7e49b5a5fa4ee78f53a183
SHA1 184459241997f81f514c95a1998a35e8fd78ebc3
SHA512 8ae9ecaa01c6e0986d493493229936fbe4f96446edde6da0bce03142f60d8cc8c9f215498ca56ff27c9049e92ac0e3b85d762cda7e7e3430b1105591c58703ec
SSDEEP 768:hKSyyp6llPaLM83TLabTDNwA+F4rf6hECV4hg:oy0llPneM60fnuug
TLSH
T1EDD239340EA774BD35ACBD8530109EACAE5D0F8B453A034627C970BA53AD5EC8F25EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 14.9MB
SHA256 7b5d1509d87db1f98d1a2e9652ca33314a6bea26685738fec48fa95b168f4d5a
MD5 1e35f53806ce1cd665bad864409cc745
SHA1 950cbef41bc2da1815bddbf6d9f6abd97a35c818
SHA512 df398cdd101b8da0ac77c27e17abb163602f96f5446df19cb5b16724db041984f17aadad50d9e8cc826e2bfdb6f2bf7acaa615f7ab3fd4e852a7356e23c92bb8
SSDEEP 49152:8l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjK:y
TLSH
T1C7F6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 7.7MB
SHA256 07f2d30e3634f08ba58a5e75e0bcb7a728d7d2f90fcd0b57e7870ffd8972595b
MD5 ed6c35dd6fc406421b00659e2a6012a0
SHA1 99e4e9546c8ebab5194498828f8c4664d0b5c86e
SHA512 a0ac75a8201b62790e2a21d662a73715b4c52e601645a59e1d845ae6dd56bfd2e5204e15decf970fe838b87edd1edca3f452bb38f065576256f1bd90276f894b
SSDEEP 49152:h5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjcjfv4iTvRC9CKpgfnoKpfd:S
TLSH
T17E869D720243FDED2F6A1D85D0043E415C9C7A5B22A8D299FF8D34BA62EA564DE3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 20KB
SHA256 e90258a4cdf9d31afe7d9522a509765953e77c567bdd6258462b082db5ea79cc
MD5 2854b5fa0b8faeb9648fda851cc1998e
SHA1 ac05c2f10731b3058dfcf97c51f48722c5104dea
SHA512 9889df8a7c0782fb303a9a5a5fa91280f8630cef850729082d7a9eabdd1a19ba8471f4e467934ebdb239e36586e95b637c1342b18525ffc68f01a1a0f3ca06a5
SSDEEP 384:dmYjcOwzQArwfTeqt4cBxSzctlzS0UzPxRuuRXaOUzYlnNzn1IbCfWNGhXcMHRli:dZcQ/fj4rcL4PDuKMYlhniCfQ4XcMHRw
TLSH
T1A39273300BE320BC32EC7D867C316EAE5E5D0B8A15B20257474A70F6626D95C9F3687E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 16KB
SHA256 5a2df4dea072e2f68911f89dd3f04fbe8eefd045b7eebaf4fc84048c85fcf35a
MD5 5a9d5036a1600dc74b73644c9692690d
SHA1 fcb7d1d13d1b45ab2ce3c8a6ac7f945c3d7d04ed
SHA512 2f06846a127d426c089663c9a18f883b3ccc82b87126edd5ec34f11698e4226b7e41a27cbadd79115d2b5508dc7157ee5364abf8565e8e14109a0e7ceff81d83
SSDEEP 384:SJH9x1MbYuutQye9FfkNyOVoE3ketzssk88uayH2ZiBhmaN:SJH9XuutQyGMNroE3O8tHEi/maN
TLSH
T112725D7446D338FD2E4C3C54B1202D586E9CAFD7656841097BCD38F693EC0A48D5AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-bTbvWlUQiXYpayRj.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-bTbvWlUQiXYpayRj.tmp
Size 15.0MB
SHA256 a4e812b6a232eb2a0c5e3ebfc31f71b598b135517ffeb96671e808b6ff4f982b
MD5 75a6055c9064bd3826b835e67cd0207e
SHA1 c18ec767acdd1203006fda31de77f0d0ea2b6e42
SHA512 2b63fbc98bc1bfef62e2a7b6bba1148e22b3b0359e0daf0a18881949eeb9738086c34ab751604749249fa0bd67caf75c42bfb0c3d25bd97658524e4ab6cc50be
SSDEEP 49152:35l0USsA0V8bHiDvxPdJB5N304rSRCBe3rVBNRoz/YJKjPnHZASQVbH0nSDwZjc+:B
TLSH
T13AF6BF320693BCBD3FBC3D45A0012E495D5D7A0B11A9935AFBC930BA63AD5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5mhzy3tg.5qi.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5mhzy3tg.5qi.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_BTSxasQd.exe

Path C:\Users\Admin\AppData\Roaming\ClearUnregister\agent_BTSxasQd.exe
Size 11.8MB
SHA256 9c324ad392ecb1e659f93a26a8f55a89fa70c0ca12a5867fcdaaf778e87bea8c
MD5 0a043ea5ff87f0923b26368631f679a1
SHA1 5caf3de44e93d8c5b13725da5ea4193702275c3c
SHA512 7f7bea7c3bf73cd9e2c38f39d983cc4f3c3174cfb9638d21abfc4f9135533510e462fb4fe7d7cba71693b246dc679c3870c3bae23551b6f41dc4a5685f491a7f
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEEA:Ac9ZeuQt+IJnAEA
TLSH
T150C65B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_oEHGHWiT.exe

Path C:\Users\Admin\AppData\Roaming\FormatPush\agent_oEHGHWiT.exe
Size 3.9MB
SHA256 f79c7dbb65e39de917bcb2ea7bf84e2cb0ba9c2c88ef2b02222142b8f66946e5
MD5 500810fd9628e28cd72527f2423a4fc0
SHA1 a50988cfb7d44b929387838e369fe0b807100c5c
SHA512 1057ca1a4b47f63ea0fb33e8ec818d1154b0099721239ea54586c687f4ca66417b6194094f73651331b5f4669e75f8ce225013b6f6ee1f0726df83ea30c3c225
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW272Ig:icVUcTedI6C9e9MQR7tg
TLSH
T13616D664EEEBC1F5FD035C30215BB23F6A3516098738DEDBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_oEHGHWiT.exe

Path C:\Users\Admin\AppData\Roaming\FormatPush\agent_oEHGHWiT.exe
Size 3.8MB
SHA256 0196aeb77217f6bf35e646c138b9fe2dd4b6eabe615fc5a429ca3d5d1f893328
MD5 a2e3d7cd3d8ff4ac455f95dc32534f5c
SHA1 c6e4a2007f12d0bc998bed90d8dff996875e00a1
SHA512 c69e5775169c7b2bd7585ddaa783419ed4689ea774100d6d9f46e33afdf4a8938c06976e0c3701845c57d52190d4341580b9d7b611dda5c474b3b173e0463802
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTRAZJIy4Dd7fAwW27e:icVUcTedI6C9e9MQR7e
TLSH
T18D06D664EEEBC1F5FD035C30115BB23F6A3516098738DEEBDB941E02E56B6A21C76206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_ipwDeIUO.exe

Path C:\Users\Admin\AppData\Roaming\InitializeUse\agent_ipwDeIUO.exe
Size 12.0MB
SHA256 7864621ead8c5f4bb6379c54762a20d48b73cf184b0d477dde4bdeabe9e4e1c8
MD5 034731c3bb179a3758c68693924fd5e1
SHA1 07943fbbaed0edf1f7c3dc9cadc4f9182049fda1
SHA512 08acad1c0bbe85363f4adb0a4e947d6dc037dd1861e147cea4f570c9535d87f61b18ff74b3704825a3ec787e53add1bded0a04a4a41de4d90c3efe4ed6ed7726
SSDEEP 98304:icVUcTedI6C9e9MQR7t+chQa4NG20CEEE:Ac9ZeuQt+IJnAE
TLSH
T144C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_hzxngmzI.exe

Path C:\Users\Admin\AppData\Roaming\UseResize\agent_hzxngmzI.exe
Size 2.3MB
SHA256 2c842db29737a7c9e96052093f22ea9d35d34f4c6bfe44e7f2108b25387c7c39
MD5 7c7b5a0a923f6aad7713d50f0f30cbde
SHA1 4a27320add45ce30358f98ba0e21048d96b57088
SHA512 63ffaec496a9f8c5a1cb465877448d8cb62c73f22219d6e4f97ee8c45179681d9f06afda43bfa3c2befcac859ed3fc543fa8816717c52ffb2ab25711126a8e85
SSDEEP 24576:TRAGnQhNmQvLHXabq2bqe7Yb6adwryCcHn4ZWMpKE/RT2a3DyFkebWjm7N+ZKVeF:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gT+
TLSH
T15BB5B664EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_hzxngmzI.exe

Path C:\Users\Admin\AppData\Roaming\UseResize\agent_hzxngmzI.exe
Size 2.4MB
SHA256 a09fc17c5a72670ef629820244147873b7754912ac8e1e4060a2fec033ebefac
MD5 01f7d0f0c3d1b2d390e182c6fdb474f8
SHA1 c6b8333a970524ea97bbe37337467aa3b3d37408
SHA512 624fab2f5c457e7ec3902e685df7cc1dbcf4be0c5996a9dfcd1e9a2eeb1f1f2ae1c518f3052319ac8c0e24fef116220d49f30f80f7687090436eb06311a6a620
SSDEEP 49152:TjycqCUjvnTGmp2TedLKtJ8CRV9e2gTR8:icVUcTedI6C9e98
TLSH
T10EC5B564EEEFC1F5ED435C30115BB23F6A3522098738DEEBDB941E02E55B7A21876206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2908-10768-0x0000000070180000-0x00000000704DB000-memory.dmp

Download

memory/2908-10758-0x0000000005F70000-0x0000000005FD6000-memory.dmp

Download

memory/2908-10778-0x0000000008DB0000-0x000000000936A000-memory.dmp

Download

memory/2908-10755-0x0000000005080000-0x00000000050B6000-memory.dmp

Download

memory/2908-10756-0x0000000005710000-0x0000000005D5A000-memory.dmp

Download

memory/2908-10757-0x0000000005DD0000-0x0000000005DF2000-memory.dmp

Download

memory/2908-10765-0x00000000069C0000-0x0000000006A08000-memory.dmp

Download

memory/2908-10759-0x0000000005FE0000-0x0000000006046000-memory.dmp

Download

memory/2908-10762-0x00000000060F0000-0x000000000644B000-memory.dmp

Download

memory/2908-10763-0x0000000006560000-0x000000000657E000-memory.dmp

Download

memory/2908-10777-0x0000000008030000-0x0000000008052000-memory.dmp

Download

memory/2908-10764-0x00000000065A0000-0x00000000065EC000-memory.dmp

Download

memory/2908-10767-0x0000000070020000-0x000000007006C000-memory.dmp

Download

memory/2908-10772-0x00000000079E0000-0x0000000007A83000-memory.dmp

Download

memory/2908-10771-0x00000000079C0000-0x00000000079E0000-memory.dmp

Download

memory/2908-10776-0x0000000007C30000-0x0000000007CC6000-memory.dmp

Download

memory/2908-10775-0x0000000007B80000-0x0000000007B8A000-memory.dmp

Download

memory/2908-10774-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Download

memory/2908-10773-0x0000000008170000-0x00000000087EC000-memory.dmp

Download

memory/2908-10766-0x0000000007980000-0x00000000079B6000-memory.dmp

Download

memory/5412-10748-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/5412-10746-0x00007FFF47140000-0x00007FFF47442000-memory.dmp

Download

memory/5412-10750-0x00007FFF47140000-0x00007FFF47442000-memory.dmp

Download

memory/5412-10747-0x0000000100400000-0x000000010043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads