Overview
overview
7Static
static
3mosquitto-...64.exe
windows10-2004-x64
7mosquitto-...64.exe
windows11-ltsc_2024-x64
7cjson.dll
windows10-2004-x64
1cjson.dll
windows11-ltsc_2024-x64
1dashboard/...sts.js
windows10-2004-x64
3dashboard/...sts.js
windows11-ltsc_2024-x64
3dashboard/...ard.js
windows10-2004-x64
3dashboard/...ard.js
windows11-ltsc_2024-x64
3dashboard/...dex.js
windows10-2004-x64
3dashboard/...dex.js
windows11-ltsc_2024-x64
3dashboard/...ers.js
windows10-2004-x64
3dashboard/...ers.js
windows11-ltsc_2024-x64
3dashboard/...bar.js
windows10-2004-x64
3dashboard/...bar.js
windows11-ltsc_2024-x64
3dashboard/index.html
windows10-2004-x64
3dashboard/index.html
windows11-ltsc_2024-x64
3dashboard/...umd.js
windows10-2004-x64
3dashboard/...umd.js
windows11-ltsc_2024-x64
3dashboard/...min.js
windows10-2004-x64
3dashboard/...min.js
windows11-ltsc_2024-x64
3dashboard/...min.js
windows10-2004-x64
3dashboard/...min.js
windows11-ltsc_2024-x64
3dashboard/...s.html
windows10-2004-x64
3dashboard/...s.html
windows11-ltsc_2024-x64
3dashboard/...er.svg
windows10-2004-x64
3dashboard/...er.svg
windows11-ltsc_2024-x64
4dashboard/...fig.js
windows10-2004-x64
3dashboard/...fig.js
windows11-ltsc_2024-x64
3dashboard/...ert.js
windows10-2004-x64
3dashboard/...ert.js
windows11-ltsc_2024-x64
3dashboard/...eue.js
windows10-2004-x64
3dashboard/...eue.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
95s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mosquitto-2.1.2-install-windows-x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
mosquitto-2.1.2-install-windows-x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
cjson.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
cjson.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
dashboard/app/consts.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
dashboard/app/consts.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
dashboard/app/dashboard.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
dashboard/app/dashboard.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
dashboard/app/index.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
dashboard/app/index.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
dashboard/app/listeners.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
dashboard/app/listeners.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
dashboard/app/sidebar.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
dashboard/app/sidebar.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
dashboard/index.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
dashboard/index.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
dashboard/lib/chart.umd.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
dashboard/lib/chart.umd.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
dashboard/lib/chartjs-plugin-zoom.min.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
dashboard/lib/chartjs-plugin-zoom.min.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
dashboard/lib/hammer.min.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
dashboard/lib/hammer.min.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
dashboard/listeners.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral24
Sample
dashboard/listeners.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral25
Sample
dashboard/media/banner.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
dashboard/media/banner.svg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral27
Sample
dashboard/tailwind/tailwind.config.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
dashboard/tailwind/tailwind.config.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
dashboard/utils/assert.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
dashboard/utils/assert.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
dashboard/utils/queue.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
dashboard/utils/queue.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target mosquitto-2.1.2-install-windows-x64.exe
- Size 25.8MB
- Sample261030-dew7dsas2k
- SHA256 58008ad7a22ada0b4073afa415801746e027c5f583e4fa52d0f4e9193b98d6aa
- MD5 661fcfa68ce6f4977a8319d7a030f57e
- SHA1 1057081bce8ce408f6138422c750d7a98e382ca3
- SHA512 1c98130c2d52e3178767c0a7c286ed40c19962962c85a6c6dafb522a11d453d9696de45b969787fd60a4adb903f9635fcf01af263ca465c198d11d3cb23bf24b
- SSDEEP 393216:e5Bsfm6cjhQ7e+DnwgNFYc4yOkLMFEVt2QNUgbsSOWI+usColS3liMooQy:egeLjhQa+7wgNaclXtEQNUgISOkujbFr
- TLSH T1F15733387052CA2BF459A1BB42074A3292EF12E55BD3DA25951F80E0E8663FB5F1FC74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 1972 VC_redist.x64.exe 2056 VC_redist.x64.exe 4328 VC_redist.x64.exe 4592 mosquitto.exe 3232 mosquitto.exe - Loads dropped DLL 15 IoCs
pid Process 5632 mosquitto-2.1.2-install-windows-x64.exe 5632 mosquitto-2.1.2-install-windows-x64.exe 2056 VC_redist.x64.exe 4592 mosquitto.exe 4592 mosquitto.exe 4592 mosquitto.exe 4592 mosquitto.exe 4592 mosquitto.exe 4592 mosquitto.exe 4592 mosquitto.exe 3232 mosquitto.exe 3232 mosquitto.exe 3232 mosquitto.exe 3232 mosquitto.exe 3232 mosquitto.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mosquitto\dashboard\media\banner.svg mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_passwd.exe mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libcommon_topic.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_options.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquittopp.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\lib\hammer.min.js mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_dynamic_security.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_connect.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_message.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\media\favicon-32x32.png mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\broker.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_publish.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\lib\chartjs-plugin-zoom.min.js mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\edl-v10 mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_signal.exe mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_persist_sqlite.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_tls.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\mqtt_protocol.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\app\index.js mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\css\styles.css mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\utils\utils.js mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_rr.exe mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\NOTICE.md mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\pskfile.example mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto.conf mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\defs.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_will.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto_broker.h mosquitto-2.1.2-install-windows-x64.exe File opened for modification C:\Program Files\Mosquitto\devel\mosquitto\libcommon_string.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_create_delete.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\app\dashboard.js mosquitto-2.1.2-install-windows-x64.exe File opened for modification C:\Program Files\Mosquitto\vc_redist.x64.exe mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_db_dump.exe mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_acl_file.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\pthreadVC3.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_unsubscribe.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\index.html mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\lib\chart.umd.js mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto.ico mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_common.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto_password_file.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\SECURITY.md mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto.lib mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto_broker.lib mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\media\mosquitto-logo.png mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\mosquitto.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\README.md mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\epl-v20 mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libcommon_file.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libcommon_utf8.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_loop.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\tailwind\styles.css mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\libmicrohttpd-dll.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\sqlite3.dll mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libcommon_random.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_helpers.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libmosquitto_socks.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\dashboard\app\listeners.js mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquittopp.lib mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libcommon.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\devel\mosquitto\libcommon_string.h mosquitto-2.1.2-install-windows-x64.exe File created C:\Program Files\Mosquitto\Uninstall.exe mosquitto-2.1.2-install-windows-x64.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3560 sc.exe 2748 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mosquitto-2.1.2-install-windows-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 4512 vssvc.exe Token: SeRestorePrivilege 4512 vssvc.exe Token: SeAuditPrivilege 4512 vssvc.exe Token: SeBackupPrivilege 4556 srtasks.exe Token: SeRestorePrivilege 4556 srtasks.exe Token: SeSecurityPrivilege 4556 srtasks.exe Token: SeTakeOwnershipPrivilege 4556 srtasks.exe Token: SeBackupPrivilege 4556 srtasks.exe Token: SeRestorePrivilege 4556 srtasks.exe Token: SeSecurityPrivilege 4556 srtasks.exe Token: SeTakeOwnershipPrivilege 4556 srtasks.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5632 wrote to memory of 2748 5632 mosquitto-2.1.2-install-windows-x64.exe 89 PID 5632 wrote to memory of 1972 5632 mosquitto-2.1.2-install-windows-x64.exe 91 PID 1972 wrote to memory of 2056 1972 VC_redist.x64.exe 92 PID 2056 wrote to memory of 4328 2056 VC_redist.x64.exe 93 PID 5632 wrote to memory of 4592 5632 mosquitto-2.1.2-install-windows-x64.exe 102 PID 5632 wrote to memory of 3560 5632 mosquitto-2.1.2-install-windows-x64.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mosquitto-2.1.2-install-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\mosquitto-2.1.2-install-windows-x64.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\sc.exesc stop mosquitto2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Program Files\Mosquitto\VC_redist.x64.exe"C:\Program Files\Mosquitto\VC_redist.x64.exe" /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\Temp\{A576CA24-7449-4259-9F6D-1983CEC47502}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{A576CA24-7449-4259-9F6D-1983CEC47502}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Mosquitto\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\Temp\{F8E17AE1-D150-40B2-B97E-059A7C4E80B9}\.be\VC_redist.x64.exe"C:\Windows\Temp\{F8E17AE1-D150-40B2-B97E-059A7C4E80B9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{EAA37715-7CF7-4204-9DB7-CB3DC7A78CBA} {DBA816D9-DC71-4EA0-8CE3-B92C6D1126ED} 20564⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4328
-
-
-
-
C:\Program Files\Mosquitto\mosquitto.exe"C:\Program Files\Mosquitto\mosquitto.exe" install2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4592
-
-
C:\Windows\SysWOW64\sc.exesc start mosquitto2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3560
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2136
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
C:\Program Files\Mosquitto\mosquitto.exe"C:\Program Files\Mosquitto\mosquitto.exe" run1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mosquitto\cjson.dll
- Size 34KB
- SHA256 03e5fc7812741175b9220dc6a85ad787401293fb4af69c264918a6f84d6f6f04
- MD5 2f58f71b0fbc5543151c5caf28f89f6a
- SHA1 9d3ed1f53eb10feb06e5bad94103cd7baa688d0d
- SHA512 a8d068c6c66375c079863aa41b069a284925a952732f4afb5d6cd4da9a419e40317b91e22d4b249637f8356019085a20d775fa617b02e269d605282d2a7f8a4d
- SSDEEP 384:DdVLuqKiGW4cfEhD7E6kjFnm4EsbsG3vCmy4w8mZpv0qJAgghA/uqkuL7ehN3UBd:ZMfGms/0T3vvJ4v9UBtV
- TLSH T177F2290FBA9404E9E29AC27A8A66584FC37331F163016BCF1F609AC66B43DE5143EF15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\libcrypto-3-x64.dll
- Size 5.1MB
- SHA256 d3305d56f91a57e452150ea4efe9f121564ec9e5ef4e5a2c13ad451fc72d94e3
- MD5 49f9d1da065bdc26fc60a1b69b020c45
- SHA1 0f3a11c990d1fed7d1382d5e2cdaab2c4857873f
- SHA512 9f579884ce8dc9106f726e9973b3ebad1c8a3535d368382199e8cb008b0d1cbc9ab15add16ae46ca78edc513f9d1c7e30f49ff6c211d95e3289b35ec3e29bd75
- SSDEEP 98304:cIkmh+Eo0w4GL3EJUb9C+aX1CPwDvt3uFlxC:cInh+Gw4GTEJWc1X1CPwDvt3uFlxC
- TLSH T101368C69B6BC0056D87AC1BCC2976227E771B82557B057DF2A2846F90F23BD42B7E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\libmicrohttpd-dll.dll
- Size 208KB
- SHA256 d67cd1815dbb63c32c09327074141819c602909a43bf3a37afda5653b5b6cbff
- MD5 79d089feadf46dd37d91614c8a09674d
- SHA1 7735e92b7acb3630c521ca370ada6f8733b9b0d4
- SHA512 a3a94db656c6d61cd68d4caf0e56828fa64089cd6a87004ee50905f661e639eec9acf5de24a67f737e959a4cf1b75a0de1a1cbac9985608fa58f16015a434c19
- SSDEEP 3072:8Okur+IFaEOHh2DnsbXvwqiAvFdnnOhP923DL6txsRRLwQBrTFtis:85urpF7OInsb/wqiAtdo6RFi
- TLSH T17D246D6577B00864EDA7807086A2D713E772BC101344D6EB07F0F2666FB32E17A3A7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\libssl-3-x64.dll
- Size 851KB
- SHA256 1f1a226fabd4f6078dba24186a73714944a396ebac8ba4f10f14eb9e8e790d90
- MD5 b6d8ba320f65c93bfe5afbbb62509b0b
- SHA1 114d193d72b17db6a2e5e3c23482f20901010fca
- SHA512 fc92e846fd0e83451602776274bb37640fb43fedd94b30e018f8937871c0a0c9aee052e818ff9b545a6c6c983770f2fd47f706cdd69ea6d351b7bed6606f4113
- SSDEEP 24576:iLWl+qQLuTlQVSPwuu3M+aKmUA2NOUAIH:iLWl1QLuoLfaRj2NOUAI
- TLSH T12D054C65BBB8019CD866D17C86934113E6B6F4173370EBEB0B648A792F63BE1263D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\mosquitto.conf
- Size 50KB
- SHA256 0352bbc96a84ad378db11f1c23b3a191d1989e9a86879163c50b8599d7200374
- MD5 aa2d164d5b361cfd347066d15d349d2e
- SHA1 2f64830e14427d658f92ab4e4065e2c66798ba94
- SHA512 205d2790003175a99351aa665e056b9261b84962105206d90d48c521452168cf63ee439fa2c4a2128521ba98121b834a0a1aea00c2f354ba362ab78afb50cf4e
- SSDEEP 768:VXvykEQ3zZRYb905YUzkTCxyN8SFqkfwXAp1HEfxEzcyvHsg/7KsHZcjbUTtVqiP:xS8fkTGyN8vZXHxmIKE8D
- TLSH T10A3375137F8A33761572C292B50AF2F9F72891AC63366510B0DDC15C2309BA9937FAD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\mosquitto.exe
- Size 335KB
- SHA256 daa688dbc3685890999084da72f98ea0fae9557f7544a2cb96b44ef46563f2a2
- MD5 29f3b2cfb12df0c00fc8629f78f80371
- SHA1 06964c7f3df61f0fb45f5f32784ae94d68a2a85c
- SHA512 1f0ebf1a6996a7f24b037a6b5edb6bf067cf4d652e7b2cb8e29763a801ea2953fac97c3af63738f7af27bec478dea0e6c6b3fd0415dc1b879912b8f70ee3119b
- SSDEEP 6144:n2g55KVfPmWw24Aq+lLuWZdEgbXD03pexiiWMDSBat1TocbbGQPZLvSCYmBG68:d5jWw24/nWTPbzQLfyw
- TLSH T1EA747D19F3642CA5E553C27881129617E7B6740427A06BEF93F0CA653B13ED6BB3E708
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\mosquitto_common.dll
- Size 42KB
- SHA256 b64ff95a71f1732610bd6c3719f728ead7c96339f1690959eea46dd46bba2680
- MD5 76401b626804500eb802e82cf93c3324
- SHA1 194dd897e5a9d634d6365ea9358391c755925aab
- SHA512 a44f43868857fee5ed0fd03fcc2c4e8bca2857ae7ea893e1d4c4d6c54fd659f8d165cb0731f2da5e1f149f2b4ed8980c39cacc7f0c02530e2f563cbc51cf48ab
- SSDEEP 768:N+A0DTebcp+xjsISf7oFN6Gf/tKdMfjoFLK2:N+A0fl+xjqf836LMfjoJD
- TLSH T11013295B97B014E9F642C0B885A2274EC17174323F71ABEF13B0C2671B97BD25A3A746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mosquitto\vc_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A576CA24-7449-4259-9F6D-1983CEC47502}\.cr\VC_redist.x64.exe
- Size 670KB
- SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
- MD5 bc9c8a6a42e8d3ea18f8da78d5031820
- SHA1 07812a4b945364d04627363e46ab38de188281b3
- SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
- SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
- TLSH T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F8E17AE1-D150-40B2-B97E-059A7C4E80B9}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{F8E17AE1-D150-40B2-B97E-059A7C4E80B9}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH