donutloader | 1dfdef98368073a0883eabefd1a26ba4e3fb0fb2b6c27f6963082c189c61e149

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER LIST AND SAMPLES_0786864GN.JS.js
Size 2.7MB
Sample261102-qs3ybatybv
SHA256 1dfdef98368073a0883eabefd1a26ba4e3fb0fb2b6c27f6963082c189c61e149
MD5 4e99bd5f4bbd439805f8e0a280c373fb
SHA1 9b3c3b7d843e79142e2913637a362512773941d7
SHA512 6df16740a15cb0934413f3cf9975d19f59e08fd629bfe90070b8b1d6248b2920f0b407cdb97538f9289f3223195a74462cac7f55326fec6ed3062d7223caa950
SSDEEP 49152:dM3z7VTzEkbcpcJSMTnu/pJ5qhXYt1EabSHLb7baZvxh6vMr8q7/QcxedvlHQ:O3z7VTzEkbcpcJSMTnu/pJ5qhXw1EISC
TLSH
T177D54B8C6372D13277216B5C57F79921890A6C3334CBDB35332CDE1A3A6994F6318AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution donutloader xworm loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.16:2477

Mutex

JzA5UcTfnxyb7jB7

Attributes

Install_directory
%Temp%
install_file
XWormClient.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5456-64-0x0000000014520000-0x0000000014530000-memory.dmp	family_xworm

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/5456-61-0x00000000025A0000-0x00000000025B2000-memory.dmp	family_donutloader
behavioral2/memory/5456-60-0x00000000025A0000-0x00000000035A0000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5892	powershell.exe
5704	powershell.exe
1840	powershell.exe
1472	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5456	CWPUZCZVYMJIMDFW.exe
1572	CWPUZCZVYMJIMDFW.exe
1816	XWormClient.exe
2496	CWPUZCZVYMJIMDFW.exe

Loads dropped DLL 2 IoCs

pid	Process
5456	CWPUZCZVYMJIMDFW.exe
1572	CWPUZCZVYMJIMDFW.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\WFDMIJMYVZCZUPWC.vbs"	CWPUZCZVYMJIMDFW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\WFDMIJMYVZCZUPWC.vbs"	CWPUZCZVYMJIMDFW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XWormClient.exe"	CWPUZCZVYMJIMDFW.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5680	WScript.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	CWPUZCZVYMJIMDFW.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CWPUZCZVYMJIMDFW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CWPUZCZVYMJIMDFW.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ORDER LIST AND SAMPLES_0786864GN.JS.js:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe
5892	powershell.exe
5892	powershell.exe
5704	powershell.exe
5704	powershell.exe
1840	powershell.exe
1840	powershell.exe
5456	CWPUZCZVYMJIMDFW.exe
5456	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
5456	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe
2496	CWPUZCZVYMJIMDFW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5456	CWPUZCZVYMJIMDFW.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeIncreaseQuotaPrivilege	1472	powershell.exe
Token: SeSecurityPrivilege	1472	powershell.exe
Token: SeTakeOwnershipPrivilege	1472	powershell.exe
Token: SeLoadDriverPrivilege	1472	powershell.exe
Token: SeSystemProfilePrivilege	1472	powershell.exe
Token: SeSystemtimePrivilege	1472	powershell.exe
Token: SeProfSingleProcessPrivilege	1472	powershell.exe
Token: SeIncBasePriorityPrivilege	1472	powershell.exe
Token: SeCreatePagefilePrivilege	1472	powershell.exe
Token: SeBackupPrivilege	1472	powershell.exe
Token: SeRestorePrivilege	1472	powershell.exe
Token: SeShutdownPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeSystemEnvironmentPrivilege	1472	powershell.exe
Token: SeRemoteShutdownPrivilege	1472	powershell.exe
Token: SeUndockPrivilege	1472	powershell.exe
Token: SeManageVolumePrivilege	1472	powershell.exe
Token: 33	1472	powershell.exe
Token: 34	1472	powershell.exe
Token: 35	1472	powershell.exe
Token: 36	1472	powershell.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	1572	CWPUZCZVYMJIMDFW.exe
Token: SeIncreaseQuotaPrivilege	5892	powershell.exe
Token: SeSecurityPrivilege	5892	powershell.exe
Token: SeTakeOwnershipPrivilege	5892	powershell.exe
Token: SeLoadDriverPrivilege	5892	powershell.exe
Token: SeSystemProfilePrivilege	5892	powershell.exe
Token: SeSystemtimePrivilege	5892	powershell.exe
Token: SeProfSingleProcessPrivilege	5892	powershell.exe
Token: SeIncBasePriorityPrivilege	5892	powershell.exe
Token: SeCreatePagefilePrivilege	5892	powershell.exe
Token: SeBackupPrivilege	5892	powershell.exe
Token: SeRestorePrivilege	5892	powershell.exe
Token: SeShutdownPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeSystemEnvironmentPrivilege	5892	powershell.exe
Token: SeRemoteShutdownPrivilege	5892	powershell.exe
Token: SeUndockPrivilege	5892	powershell.exe
Token: SeManageVolumePrivilege	5892	powershell.exe
Token: 33	5892	powershell.exe
Token: 34	5892	powershell.exe
Token: 35	5892	powershell.exe
Token: 36	5892	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeIncreaseQuotaPrivilege	5704	powershell.exe
Token: SeSecurityPrivilege	5704	powershell.exe
Token: SeTakeOwnershipPrivilege	5704	powershell.exe
Token: SeLoadDriverPrivilege	5704	powershell.exe
Token: SeSystemProfilePrivilege	5704	powershell.exe
Token: SeSystemtimePrivilege	5704	powershell.exe
Token: SeProfSingleProcessPrivilege	5704	powershell.exe
Token: SeIncBasePriorityPrivilege	5704	powershell.exe
Token: SeCreatePagefilePrivilege	5704	powershell.exe
Token: SeBackupPrivilege	5704	powershell.exe
Token: SeRestorePrivilege	5704	powershell.exe
Token: SeShutdownPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeSystemEnvironmentPrivilege	5704	powershell.exe
Token: SeRemoteShutdownPrivilege	5704	powershell.exe
Token: SeUndockPrivilege	5704	powershell.exe
Token: SeManageVolumePrivilege	5704	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5456	CWPUZCZVYMJIMDFW.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4120	3228	wscript.exe	89
PID 3228 wrote to memory of 5456	3228	wscript.exe	91
PID 5456 wrote to memory of 1472	5456	CWPUZCZVYMJIMDFW.exe	95
PID 5680 wrote to memory of 1572	5680	WScript.exe	97
PID 5456 wrote to memory of 5892	5456	CWPUZCZVYMJIMDFW.exe	100
PID 5456 wrote to memory of 5704	5456	CWPUZCZVYMJIMDFW.exe	102
PID 5456 wrote to memory of 1840	5456	CWPUZCZVYMJIMDFW.exe	104
PID 5456 wrote to memory of 5640	5456	CWPUZCZVYMJIMDFW.exe	109
PID 5640 wrote to memory of 2136	5640	csc.exe	111
PID 5456 wrote to memory of 2496	5456	CWPUZCZVYMJIMDFW.exe	112
PID 5456 wrote to memory of 3128	5456	CWPUZCZVYMJIMDFW.exe	114
PID 3128 wrote to memory of 4848	3128	csc.exe	116

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CWPUZCZVYMJIMDFW.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\ORDER LIST AND SAMPLES_0786864GN.JS.js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\ORDER LIST AND SAMPLES_0786864GN.JS.js:Zone.Identifier"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:4120
- C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe
  "C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe" C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CWPUZCZVYMJIMDFW.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_35b62bc0b43941d18c6d594dc6f89f0f.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES68F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC77D7D3F3D59A48FE92C28DCDB1C217C.TMP"
      4⤵
      PID:2136
- - C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe
    "C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe" 5456
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2496
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_38c5370f299c4709aa7e94080df193f4.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E3C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4DF698EF6BB43559B5DEB4E72D1EC8B.TMP"
      4⤵
      PID:4848

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe
  "C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe" "C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1572

C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe
1⤵
- Executes dropped EXE
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d6adf751a6c0c74bed0bd08508cb3078afcaaba6514718c0db9792bb6a1a02fa
MD5 b20ad66a34d257086e53a5b2b34a7b45
SHA1 65acca05f0cb24d786b137cdb05f8af99ccbf9b7
SHA512 4fe111c650bbe2fb71c9be6826f810c97faa9f05e84c2d31c41f1651f91575fa66dc6bb5c2d85cddb9861b3864bbe52823e1bb46971b1e34dfa34dadf40cd558
TLSH
T181219833B3DC8614C89A003A10CDAC1036B6CBCB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2307028c768767d7f131a8c5b416037f6bc975943dec7491be7a5738777dbd1c
MD5 062e05f435c032fb0b6df70feb495c1f
SHA1 55cdc13d4ec5e1f2db15cfbf957101629d4a1107
SHA512 6cb19e340bcc83e014b72c8a58eb1bdbc85610328aedb6f0ce716616b13072f8182741d708911c832715c50746acf2eeb94d4b6e829c7474e54fa19c6e4341c5
TLSH
T1A3216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

CWPUZCZVYMJIMDFW.exe

Path C:\Users\Admin\AppData\Local\Temp\CWPUZCZVYMJIMDFW.exe
Size 5KB
SHA256 64da69b15d1291f146964e50f5b1a084b8bd35d1bdda4fe7c158aa510648dc3b
MD5 aaf9868514f40e4d047ab41d4864f4e8
SHA1 ebdb6edf61509bbeb46b68ab1b6730b873a5d70a
SHA512 2182be3e9b124e02231c0b2dd18ca050334fdfd153fb84bcb321344f9c0758021817ec270b8461965b38884d726569da79144e232c8a6d43a2abb65e5f7317e9
SSDEEP 96:Idew7V9bW8KQb2B8BynqgHlNxGEa7fXSzzNt:IvPCZoyqgHjNa7KV
TLSH
T154C1E64297CC4766D0A307717CB3035127B8E8224BBBA7AF29E0037A6EE979049533F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES68F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES68F1.tmp
Size 1KB
SHA256 13a9c456a368b678c9f653bc223132626e667d2468e0e4f2a9eafe7c00b7b60a
MD5 a65e1a91ec17396d6fd051faacfeee21
SHA1 8883e30ef67b806248ddb8ee5d2fe59821041663
SHA512 ab3f1cd18fb65999e5b2f7bb1bce5548f3e1ffd59976bfce7448ed3eefce92b8d8601de8fe426e7db182a723cbbd6f2630dc8d510a95b878766f06d33e68fc7a
TLSH
T1F741864083D84F1FE1B387316CF78719A279FD159E9A435DB488122E1E02780CDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RES8E3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8E3C.tmp
Size 1KB
SHA256 a9a14e4bd04ade8fefd57b40559b647e92b8cacb2dd7b86df6fd5b59af6fcf16
MD5 def724a8fce00072d952465b4340a1ac
SHA1 74db748017ef791df136ca7a055d0a715f06122c
SHA512 835f1503de8938da2bc8ed6f7307332fe4e759c235c64f7716570659cdf6199585b4db6b2287e386eb9cba6c384f5ed25f14a77c47aedc2aef573eaabe498683
TLSH
T1A241614183D84B1FE1B387316DF78729A279BE559EAA435EB084222E1E02740CCC3271
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zunewvbq.lki.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zunewvbq.lki.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CWPUZCZVYMJIMDFW.exe

Path C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.exe
Size 27KB
SHA256 70916418ff0b6c2a12e8897ff622bdbb115435d38f0afe3ea981de1e7652ebb4
MD5 a989e1ff8e0e2a090e65226a2cfc6315
SHA1 31b7e7644a1445ebe7ee90b8100ece52374777dc
SHA512 ca2314748e9e65462f01a1c51754d17f93bbc1ef47dc84cac784c36744184c5f5ebec370fce138dfd8c22196f87b58a91f28185cb88a9fd716e05cea6c8ed6d3
SSDEEP 192:V2JOj62kV6yge14ANwRZTrA3GfQJkd4+G7SgrgX/QgESiIU8ZcGwuttnhlM49abK:vkAe/QZvfQm49Xr4IJXutRU499mgYPWt
TLSH
T1B6C2F73FB6565CFEC142C37898D746327072782197232A6F0718A632AF71B749A6F12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CWPUZCZVYMJIMDFW.mui

Path C:\Users\Admin\Documents\CWPUZCZVYMJIMDFW.mui
Size 2B
SHA256 e3d6c4d4599e00882384ca981ee287ed961fa5f3828e2adb5e9ea890ab0d0525
MD5 f4b9ec30ad9f68f89b29639786cb62ef
SHA1 215bb47da8fac3342b858ac3db09b033c6c46e0b
SHA512 85eb108b7e36af2b00ba3e0bc2e2ece782fbf86ef4946df5f91b8ddd978a559f4a6e4f8896b4dc7deb1ba22703ffc5dcefb650c54c60bc8d98b2411a5c2191f1
MD5 SHA1 SHA512

Submit Download

WFDMIJMYVZCZUPWC

Path C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC
Size 317KB
SHA256 fd06c79d4c3023eaa79278b21fac7a7f84d07b9eceb311810df1bad38dd91b05
MD5 989d650ac452f8576b55e21ccff4503f
SHA1 5c02ad152a55aaade0617a14da0e7fe52c1d92aa
SHA512 b528b4c5c8cd281ad55d1adbf29165d806a3277feceb8a0d5061d08f638cc7eeb89edc4018e4936f9c7adc8337ce06470792a0a7a44e21a3ddcd15ada546366a
SSDEEP 6144:g18K3uBgfxfL32A7PGpRTeBjj/pSVFr1xUtAzcVV:JY2ePGpRTeBjj/pSVFr1xUtAzcVV
TLSH
T1006472C7748E29A492EE42B0CC6B0A9B70B5C9F6034E56474F94D0F4639167CCBED93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WFDMIJMYVZCZUPWC.vbs

Path C:\Users\Admin\Documents\WFDMIJMYVZCZUPWC.vbs
Size 234B
SHA256 69b69496717db0c619632177561250ef12091fff1310dac548dece6e543b8e47
MD5 245192a68bd91dae7f810ee58d907045
SHA1 f259324d0d00bc5fed2ce43a6c4eee9c77afbe25
SHA512 c6fffc6ec1eceae30e2a3b6df94191d2640e0223db776ccca439d51907ee869b9b31ad71243c843ac6b82cbbf56b6634a174487e8fc6d29da22b8f1fd951e55f
TLSH
T110D0A709D4FCD7251044C0662BB0940DDF985E57541EB41D46088C4416009A41247783
MD5 SHA1 SHA512 TLSH

Submit Download

lua51.dll

Path C:\Users\Admin\Documents\lua51.dll
Size 439KB
SHA256 2f52407927015a8bf4a2a6765ccb599bc438c9a19e1d4a5dda1f5292a0c0e50a
MD5 028b7c1c451765479927a369b0766fa2
SHA1 c960a19bd5f5d86d2629f102c175984015885f40
SHA512 424a5b472845d75055642d6abc8802a4abdff845c0910f8fc346b627071ba1cf515903864878a95ba6b944e5cc9ef006e1de5ee0b486c6bf5ba24d85c26aa496
SSDEEP 12288:eThHrqR5EtmwgObhTLRFA8nmKlTD8ju3F3Mx:eN85EtmgvHmyTDeu3F3Mx
TLSH
T1AEA4380BA2B356BCC6678170876BAB72A931FC1511307DBE1998FB312D31D909B9F52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC77D7D3F3D59A48FE92C28DCDB1C217C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC77D7D3F3D59A48FE92C28DCDB1C217C.TMP
Size 1KB
SHA256 cc558fe59225dee05062a536cbf1424264dddb0901bda39090cc010dddfd169a
MD5 8187d10bf4286274369f632b992308c0
SHA1 446dbebe0c696fe6505631fccfeb826704e36eba
SHA512 1a4554f074a54f0139398fc9303fc23daca539f2e3905e1fee87455a53d3ed48913aa0986915534e16ed8cc9ee7fab4141d63a3378ec5c8e97c49adf21f6a80c
TLSH
T1B821CC81A2E8461EF2F39BB079F5C36291ADBE268D7A43DC7488175F5B15A40C4836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_35b62bc0b43941d18c6d594dc6f89f0f.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_35b62bc0b43941d18c6d594dc6f89f0f.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1472-80-0x000001B0351A0000-0x000001B035252000-memory.dmp

Download

memory/1472-79-0x000001B035180000-0x000001B03519E000-memory.dmp

Download

memory/1472-81-0x000001B035170000-0x000001B03517A000-memory.dmp

Download

memory/1472-72-0x000001B034FB0000-0x000001B034FD2000-memory.dmp

Download

memory/1572-89-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-99-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-91-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-92-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-93-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-94-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-88-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-95-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-96-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-97-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-98-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-90-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-83-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-82-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-87-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-86-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-85-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-84-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-75-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/1572-76-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/2496-167-0x0000000000760000-0x0000000000768000-memory.dmp

Download

memory/5456-24-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-43-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-42-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-41-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-40-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-50-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-49-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-44-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-61-0x00000000025A0000-0x00000000025B2000-memory.dmp

Download

memory/5456-62-0x00007FF866A6F000-0x00007FF866A70000-memory.dmp

Download

memory/5456-60-0x00000000025A0000-0x00000000035A0000-memory.dmp

Download

memory/5456-63-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-64-0x0000000014520000-0x0000000014530000-memory.dmp

Download

memory/5456-65-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-66-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-67-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-46-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-69-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-47-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-48-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-51-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-52-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-53-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-54-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-55-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-56-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-57-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-58-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-59-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-45-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-39-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-21-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-25-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-27-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-22-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-23-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-26-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-29-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-30-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-31-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-32-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-33-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-34-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-35-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-36-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-37-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-150-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-151-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/5456-154-0x000000002FD70000-0x000000002FDEC000-memory.dmp

Download

memory/5456-155-0x000000002FDF0000-0x000000002FDF8000-memory.dmp

Download

memory/5456-38-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-28-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-18-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-17-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-16-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download

memory/5456-168-0x00000000302A0000-0x0000000030462000-memory.dmp

Download

memory/5456-171-0x000000002FB70000-0x000000002FBA4000-memory.dmp

Download

memory/5456-172-0x000000002D100000-0x000000002D106000-memory.dmp

Download

memory/5456-15-0x0000000057FD0000-0x0000000057FE0000-memory.dmp

Download