donutloader | 1dfdef98368073a0883eabefd1a26ba4e3fb0fb2b6c27f6963082c189c61e149

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER LIST AND SAMPLES_0786864GN.js
Size 2.7MB
Sample261102-pm6xcatvex
SHA256 1dfdef98368073a0883eabefd1a26ba4e3fb0fb2b6c27f6963082c189c61e149
MD5 4e99bd5f4bbd439805f8e0a280c373fb
SHA1 9b3c3b7d843e79142e2913637a362512773941d7
SHA512 6df16740a15cb0934413f3cf9975d19f59e08fd629bfe90070b8b1d6248b2920f0b407cdb97538f9289f3223195a74462cac7f55326fec6ed3062d7223caa950
SSDEEP 49152:dM3z7VTzEkbcpcJSMTnu/pJ5qhXYt1EabSHLb7baZvxh6vMr8q7/QcxedvlHQ:O3z7VTzEkbcpcJSMTnu/pJ5qhXw1EISC
TLSH
T177D54B8C6372D13277216B5C57F79921890A6C3334CBDB35332CDE1A3A6994F6318AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution donutloader xworm loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.16:2477

Mutex

JzA5UcTfnxyb7jB7

Attributes

Install_directory
%Temp%
install_file
XWormClient.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5164-65-0x0000000002620000-0x0000000002630000-memory.dmp	family_xworm

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/5164-61-0x0000000002640000-0x0000000002652000-memory.dmp	family_donutloader
behavioral2/memory/5164-60-0x0000000002640000-0x0000000003640000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3524	powershell.exe
5492	powershell.exe
4820	powershell.exe
5052	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5164	CWPUZCZVYMJIMDFW.exe
4668	CWPUZCZVYMJIMDFW.exe
2684	XWormClient.exe
5824	CWPUZCZVYMJIMDFW.exe

Loads dropped DLL 2 IoCs

pid	Process
5164	CWPUZCZVYMJIMDFW.exe
4668	CWPUZCZVYMJIMDFW.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\WFDMIJMYVZCZUPWC.vbs"	CWPUZCZVYMJIMDFW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\WFDMIJMYVZCZUPWC.vbs"	CWPUZCZVYMJIMDFW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XWormClient.exe"	CWPUZCZVYMJIMDFW.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1708	WScript.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	CWPUZCZVYMJIMDFW.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1084	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CWPUZCZVYMJIMDFW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CWPUZCZVYMJIMDFW.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	WScript.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ORDER LIST AND SAMPLES_0786864GN.js:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3524	powershell.exe
3524	powershell.exe
3524	powershell.exe
5492	powershell.exe
5492	powershell.exe
5492	powershell.exe
4820	powershell.exe
4820	powershell.exe
5052	powershell.exe
5052	powershell.exe
5164	CWPUZCZVYMJIMDFW.exe
5164	CWPUZCZVYMJIMDFW.exe
5164	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5164	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe
5824	CWPUZCZVYMJIMDFW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	CWPUZCZVYMJIMDFW.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeIncreaseQuotaPrivilege	3524	powershell.exe
Token: SeSecurityPrivilege	3524	powershell.exe
Token: SeTakeOwnershipPrivilege	3524	powershell.exe
Token: SeLoadDriverPrivilege	3524	powershell.exe
Token: SeSystemProfilePrivilege	3524	powershell.exe
Token: SeSystemtimePrivilege	3524	powershell.exe
Token: SeProfSingleProcessPrivilege	3524	powershell.exe
Token: SeIncBasePriorityPrivilege	3524	powershell.exe
Token: SeCreatePagefilePrivilege	3524	powershell.exe
Token: SeBackupPrivilege	3524	powershell.exe
Token: SeRestorePrivilege	3524	powershell.exe
Token: SeShutdownPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeSystemEnvironmentPrivilege	3524	powershell.exe
Token: SeRemoteShutdownPrivilege	3524	powershell.exe
Token: SeUndockPrivilege	3524	powershell.exe
Token: SeManageVolumePrivilege	3524	powershell.exe
Token: 33	3524	powershell.exe
Token: 34	3524	powershell.exe
Token: 35	3524	powershell.exe
Token: 36	3524	powershell.exe
Token: SeDebugPrivilege	4668	CWPUZCZVYMJIMDFW.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeIncreaseQuotaPrivilege	5492	powershell.exe
Token: SeSecurityPrivilege	5492	powershell.exe
Token: SeTakeOwnershipPrivilege	5492	powershell.exe
Token: SeLoadDriverPrivilege	5492	powershell.exe
Token: SeSystemProfilePrivilege	5492	powershell.exe
Token: SeSystemtimePrivilege	5492	powershell.exe
Token: SeProfSingleProcessPrivilege	5492	powershell.exe
Token: SeIncBasePriorityPrivilege	5492	powershell.exe
Token: SeCreatePagefilePrivilege	5492	powershell.exe
Token: SeBackupPrivilege	5492	powershell.exe
Token: SeRestorePrivilege	5492	powershell.exe
Token: SeShutdownPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeSystemEnvironmentPrivilege	5492	powershell.exe
Token: SeRemoteShutdownPrivilege	5492	powershell.exe
Token: SeUndockPrivilege	5492	powershell.exe
Token: SeManageVolumePrivilege	5492	powershell.exe
Token: 33	5492	powershell.exe
Token: 34	5492	powershell.exe
Token: 35	5492	powershell.exe
Token: 36	5492	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeIncreaseQuotaPrivilege	4820	powershell.exe
Token: SeSecurityPrivilege	4820	powershell.exe
Token: SeTakeOwnershipPrivilege	4820	powershell.exe
Token: SeLoadDriverPrivilege	4820	powershell.exe
Token: SeSystemProfilePrivilege	4820	powershell.exe
Token: SeSystemtimePrivilege	4820	powershell.exe
Token: SeProfSingleProcessPrivilege	4820	powershell.exe
Token: SeIncBasePriorityPrivilege	4820	powershell.exe
Token: SeCreatePagefilePrivilege	4820	powershell.exe
Token: SeBackupPrivilege	4820	powershell.exe
Token: SeRestorePrivilege	4820	powershell.exe
Token: SeShutdownPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeSystemEnvironmentPrivilege	4820	powershell.exe
Token: SeRemoteShutdownPrivilege	4820	powershell.exe
Token: SeUndockPrivilege	4820	powershell.exe
Token: SeManageVolumePrivilege	4820	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5164	CWPUZCZVYMJIMDFW.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1084	4956	wscript.exe	89
PID 4956 wrote to memory of 5164	4956	wscript.exe	91
PID 1708 wrote to memory of 4668	1708	WScript.exe	95
PID 5164 wrote to memory of 3524	5164	CWPUZCZVYMJIMDFW.exe	97
PID 5164 wrote to memory of 5492	5164	CWPUZCZVYMJIMDFW.exe	100
PID 5164 wrote to memory of 4820	5164	CWPUZCZVYMJIMDFW.exe	102
PID 5164 wrote to memory of 5052	5164	CWPUZCZVYMJIMDFW.exe	104
PID 5164 wrote to memory of 4784	5164	CWPUZCZVYMJIMDFW.exe	110
PID 5164 wrote to memory of 5088	5164	CWPUZCZVYMJIMDFW.exe	112
PID 4784 wrote to memory of 5368	4784	csc.exe	114
PID 5164 wrote to memory of 5824	5164	CWPUZCZVYMJIMDFW.exe	115
PID 5088 wrote to memory of 4348	5088	csc.exe	116

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\ORDER LIST AND SAMPLES_0786864GN.js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\ORDER LIST AND SAMPLES_0786864GN.js:Zone.Identifier"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:1084
- C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe
  "C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe" C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CWPUZCZVYMJIMDFW.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5052
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_802fe167953f45c6928cb0ecdcbabbcc.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES799B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC21DE4B24614F559264DEEB8527C36.TMP"
      4⤵
      PID:5368
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_9b67cd2c6c2c493c8b09d344e0082ae0.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AA5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC878FAFF9B818434D91E121487BFA5DD0.TMP"
      4⤵
      PID:4348
- - C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe
    "C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe" 5164
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5824

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe
  "C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe" "C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4668

C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
1⤵
- Executes dropped EXE
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 91826b5a6b5a9ef79f284c0eeecc298c774e994947d7085b146f596214b239bd
MD5 a87d88fe68aa26bcbe3c12d6cbea4d36
SHA1 e7d870b702022a971026b4a65921b5b3989ef5b5
SHA512 7debe359d7cfb4dc848eac34840b68dd1ade6dde64544bea6ea171115b778d0fbaada0ae52fab8d352904259c45423c5b7502380e0dd12f2e80cd2eaec76030b
TLSH
T11B216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f37afed98e5008dc276f9ddd26ca208402a8c1cb8a55112fd7f09d344b3e0d3c
MD5 1624b7a84621795477045434eb429b01
SHA1 791ca1cf6f768ebb2cacd7bd831bfb53466c64bb
SHA512 6d9cedee518636f7d80c2eb776e1f7b272c5c62dba2f1297ec92db44a4d5524f955f01474e971908517fed1bdf97e2fbe0bf2cb06701dd8d98eef771f9920891
TLSH
T1AA216837B3DD8624C89A413A10CDAD1036B6CBDB40DECE5B7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

CWPUZCZVYMJIMDFW.exe

Path C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe
Size 5KB
SHA256 dadff99bb2143d1662c10487fcd3bcd9aef0245bdf9b0507082f1c3e25c24b3a
MD5 9fd78c9f169dc7e58e0f3831c81ed9bb
SHA1 6b1a834544262e00903b642140af8777212aa288
SHA512 d69bbb944d1c7e61e9bcab9767a2f7975aedd269ef7bd14da3e6218a72473bfc420cbae1a4176f5a648f4501e105255394e669c397384a238cd92f0d884887b5
SSDEEP 96:kdew7V9bW8KQb2B8BynqgHlNxGEz7fXSzzNt:kvPCZoyqgHjNz7KV
TLSH
T1F2C1F84797CC4766D06307717CB303512778E8224BBBA7AF29E0137A6EE979049527F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES799B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES799B.tmp
Size 1KB
SHA256 8348492fe2f3533c1f9d144c919a1fc7cb19d13a63f55c410739467c9be56d25
MD5 6a26c2ed550993afb6047e8e2c5b1c28
SHA1 6170907bfab6520f1d18fdef622646287e02bec9
SHA512 47c2dcb77b7f76b9864181d4233abd376cd02404146a1893740d968716a4eff0d64f883e13f114a4c7b984ecd3771392aa9c1cdbf38b9449f147b44ce101cd4a
TLSH
T11E41444083D84B5EE173977128F75729E6B9FD559E9A434DB484122E1E02740CDC3671
MD5 SHA1 SHA512 TLSH

Submit Download

RES7AA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7AA5.tmp
Size 1KB
SHA256 6d30d21a919bfd373f0129b6b7fe218b24c05fd301add159dc48047ccdb0d2ec
MD5 96536f1f0ea4f6b2eb658b96cba1552a
SHA1 58e19874e710fbdfa12dcf67ffcdf5ebb629499f
SHA512 80790752858d0a34529c9d3fc4adc1f250d1b2ade148f9031b863edaab699228638509aa8efbaa500d126cf3f273cd927fba83a961b66eaac986d768c7c1d92b
TLSH
T1CB41834093D84B1FE17287316DF78719A679FE549E9A434DB4C8122E1E02740CDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t2xacosf.ibp.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t2xacosf.ibp.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CWPUZCZVYMJIMDFW.exe

Path C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe
Size 27KB
SHA256 70916418ff0b6c2a12e8897ff622bdbb115435d38f0afe3ea981de1e7652ebb4
MD5 a989e1ff8e0e2a090e65226a2cfc6315
SHA1 31b7e7644a1445ebe7ee90b8100ece52374777dc
SHA512 ca2314748e9e65462f01a1c51754d17f93bbc1ef47dc84cac784c36744184c5f5ebec370fce138dfd8c22196f87b58a91f28185cb88a9fd716e05cea6c8ed6d3
SSDEEP 192:V2JOj62kV6yge14ANwRZTrA3GfQJkd4+G7SgrgX/QgESiIU8ZcGwuttnhlM49abK:vkAe/QZvfQm49Xr4IJXutRU499mgYPWt
TLSH
T1B6C2F73FB6565CFEC142C37898D746327072782197232A6F0718A632AF71B749A6F12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CWPUZCZVYMJIMDFW.mui

Path C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.mui
Size 2B
SHA256 6208ef0f7750c111548cf90b6ea1d0d0a66f6bff40dbef07cb45ec436263c7d6
MD5 66f041e16a60928b05a7e228a89c3799
SHA1 667be543b02294b7624119adc3a725473df39885
SHA512 8f8541b065653434370e0dd0f930ae0586c66a5235723b22e478daf1bee34865b05e9d5b86b1391c9ef575c2f47a967434e2b3f11a0f78e1133f2a89ce0a6d9f
MD5 SHA1 SHA512

Submit Download

WFDMIJMYVZCZUPWC

Path C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC
Size 317KB
SHA256 fd06c79d4c3023eaa79278b21fac7a7f84d07b9eceb311810df1bad38dd91b05
MD5 989d650ac452f8576b55e21ccff4503f
SHA1 5c02ad152a55aaade0617a14da0e7fe52c1d92aa
SHA512 b528b4c5c8cd281ad55d1adbf29165d806a3277feceb8a0d5061d08f638cc7eeb89edc4018e4936f9c7adc8337ce06470792a0a7a44e21a3ddcd15ada546366a
SSDEEP 6144:g18K3uBgfxfL32A7PGpRTeBjj/pSVFr1xUtAzcVV:JY2ePGpRTeBjj/pSVFr1xUtAzcVV
TLSH
T1006472C7748E29A492EE42B0CC6B0A9B70B5C9F6034E56474F94D0F4639167CCBED93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WFDMIJMYVZCZUPWC.vbs

Path C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC.vbs
Size 234B
SHA256 69b69496717db0c619632177561250ef12091fff1310dac548dece6e543b8e47
MD5 245192a68bd91dae7f810ee58d907045
SHA1 f259324d0d00bc5fed2ce43a6c4eee9c77afbe25
SHA512 c6fffc6ec1eceae30e2a3b6df94191d2640e0223db776ccca439d51907ee869b9b31ad71243c843ac6b82cbbf56b6634a174487e8fc6d29da22b8f1fd951e55f
TLSH
T110D0A709D4FCD7251044C0662BB0940DDF985E57541EB41D46088C4416009A41247783
MD5 SHA1 SHA512 TLSH

Submit Download

lua51.dll

Path C:\Users\Admin\Documents\lua51.dll
Size 439KB
SHA256 2f52407927015a8bf4a2a6765ccb599bc438c9a19e1d4a5dda1f5292a0c0e50a
MD5 028b7c1c451765479927a369b0766fa2
SHA1 c960a19bd5f5d86d2629f102c175984015885f40
SHA512 424a5b472845d75055642d6abc8802a4abdff845c0910f8fc346b627071ba1cf515903864878a95ba6b944e5cc9ef006e1de5ee0b486c6bf5ba24d85c26aa496
SSDEEP 12288:eThHrqR5EtmwgObhTLRFA8nmKlTD8ju3F3Mx:eN85EtmgvHmyTDeu3F3Mx
TLSH
T1AEA4380BA2B356BCC6678170876BAB72A931FC1511307DBE1998FB312D31D909B9F52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC21DE4B24614F559264DEEB8527C36.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC21DE4B24614F559264DEEB8527C36.TMP
Size 1KB
SHA256 cc558fe59225dee05062a536cbf1424264dddb0901bda39090cc010dddfd169a
MD5 8187d10bf4286274369f632b992308c0
SHA1 446dbebe0c696fe6505631fccfeb826704e36eba
SHA512 1a4554f074a54f0139398fc9303fc23daca539f2e3905e1fee87455a53d3ed48913aa0986915534e16ed8cc9ee7fab4141d63a3378ec5c8e97c49adf21f6a80c
TLSH
T1B821CC81A2E8461EF2F39BB079F5C36291ADBE268D7A43DC7488175F5B15A40C4836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_802fe167953f45c6928cb0ecdcbabbcc.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_802fe167953f45c6928cb0ecdcbabbcc.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3524-101-0x000002265BB80000-0x000002265BB8A000-memory.dmp

Download

memory/3524-96-0x000002265B7F0000-0x000002265B812000-memory.dmp

Download

memory/3524-100-0x000002265BAC0000-0x000002265BB72000-memory.dmp

Download

memory/3524-99-0x000002265BAA0000-0x000002265BABE000-memory.dmp

Download

memory/4668-79-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-86-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-81-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-82-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-83-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-78-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-84-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-77-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-85-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-80-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-87-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-76-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-88-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-89-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-90-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-91-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-75-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-74-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-71-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/4668-72-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-25-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-43-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-45-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-42-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-41-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-40-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-55-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-49-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-44-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-46-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-60-0x0000000002640000-0x0000000003640000-memory.dmp

Download

memory/5164-62-0x00007FFC0AD5F000-0x00007FFC0AD60000-memory.dmp

Download

memory/5164-63-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-64-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-65-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/5164-66-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-67-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-48-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-50-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-51-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-73-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-52-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-53-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-54-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-56-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-57-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-58-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-59-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-61-0x0000000002640000-0x0000000002652000-memory.dmp

Download

memory/5164-47-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-39-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-24-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-26-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-27-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-28-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-29-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-32-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-34-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-35-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-36-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-37-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-38-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-31-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-33-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-30-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-23-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-22-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-148-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-152-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/5164-155-0x000000002FD70000-0x000000002FDA4000-memory.dmp

Download

memory/5164-156-0x000000002E640000-0x000000002E646000-memory.dmp

Download

memory/5164-21-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-161-0x000000002FFC0000-0x000000003003C000-memory.dmp

Download

memory/5164-162-0x000000002E650000-0x000000002E658000-memory.dmp

Download

memory/5164-18-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-17-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-16-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5164-180-0x000000002DF70000-0x000000002E132000-memory.dmp

Download

memory/5164-15-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5824-174-0x0000000000250000-0x0000000000258000-memory.dmp

Download