roningloader | 2b24dce2ba941a8be030a7b4496260910a066f6a7124dd867939b85762404a1e

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image_2025-12-31_12-46-16.exe
Size 3.2MB
Sample261104-wd77daeb26
SHA256 2b24dce2ba941a8be030a7b4496260910a066f6a7124dd867939b85762404a1e
MD5 4856dbb097471d8131b94f1de3e75732
SHA1 f997aeb5f1c5cad73bf0d94d0f6d09d9464a5b80
SHA512 fdfb670d3bfe02b64a63394305eda9f0e816ba2604d9b594ad21c8d606120a8bd7f0723a924732bec96268bc02dc7bd804326997dff26614e152a26085daffcb
SSDEEP 49152:Ed71jCRgt3JkoTH+05s4XkDwJ8MCX2aA2dot2yRkXt6nOK5UfkB3b76PZ30VHL:Ed71Ygt3qeXGuaj9oxkXt6JJ/6Pd0B
TLSH
T11CE533393176E57AD80B4F358DB580E6B5307C7E7A4681AE26E43F8FE2BE485BD04610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

dragon_breath apt defense_evasion discovery execution roningloader loader privilege_escalation

Malware Config

Signatures

Family: RoningLoader
RoningLoader is a multi-stage malware loader used by the Dragon Breath APT.
loader roningloader

Detects RoningLoader loader 19 IoCs

loader apt dragon_breath

resource	yara_rule
behavioral2/memory/1080-27-0x00000290BD9D0000-0x00000290BDC8A000-memory.dmp	family_roningloader
behavioral2/memory/1080-44-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-39-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-38-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-37-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-36-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-34-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-33-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-32-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-31-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-29-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-30-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-43-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-40-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-35-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-28-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-45-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-82-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader
behavioral2/memory/1080-84-0x0000000140000000-0x00000001402BF000-memory.dmp	family_roningloader

Executes dropped EXE 2 IoCs

pid	Process
1080	aJx1NIFv.exe
5848	vmservice.sys

Loads dropped DLL 7 IoCs

pid	Process
4648	image_2025-12-31_12-46-16.exe
4648	image_2025-12-31_12-46-16.exe
4648	image_2025-12-31_12-46-16.exe
4648	image_2025-12-31_12-46-16.exe
4648	image_2025-12-31_12-46-16.exe
1080	aJx1NIFv.exe
4928	regsvr32.exe

Discovers running processes 1 TTPs 15 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4068	tasklist.exe
5812	tasklist.exe
5320	tasklist.exe
4708	tasklist.exe
5988	tasklist.exe
2548	tasklist.exe
5112	tasklist.exe
5844	tasklist.exe
3760	tasklist.exe
2404	tasklist.exe
4672	tasklist.exe
480	tasklist.exe
1496	tasklist.exe
5980	tasklist.exe
3236	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{31351756-3F24-4963-8380-4E7602335AAE}.cip	aJx1NIFv.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\H3lWKj.3v	image_2025-12-31_12-46-16.exe
File created	C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\WindowsCamera.dll	image_2025-12-31_12-46-16.exe
File created	C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\aJx1NIFv.exe	image_2025-12-31_12-46-16.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\windows\IbqcjbebHf.bat	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5472	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aJx1NIFv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aJx1NIFv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	image_2025-12-31_12-46-16.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
4352	timeout.exe
2276	timeout.exe
3416	timeout.exe
4152	timeout.exe
5936	timeout.exe
4088	timeout.exe
3292	timeout.exe
1568	timeout.exe
3364	timeout.exe
2256	timeout.exe
1336	timeout.exe
2592	timeout.exe
4840	timeout.exe
1648	timeout.exe
4080	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	image_2025-12-31_12-46-16.exe
4648	image_2025-12-31_12-46-16.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
1080	aJx1NIFv.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found
4912	Process not Found

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5012	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	aJx1NIFv.exe
Token: SeDebugPrivilege	5012	elevation_service.exe
Token: SeDebugPrivilege	2548	tasklist.exe
Token: SeDebugPrivilege	1080	aJx1NIFv.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	5844	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	480	tasklist.exe
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	5988	tasklist.exe
Token: SeDebugPrivilege	3760	tasklist.exe
Token: SeDebugPrivilege	1496	tasklist.exe
Token: SeDebugPrivilege	5320	tasklist.exe
Token: SeDebugPrivilege	5980	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	4672	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	Process not Found

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1080	4648	image_2025-12-31_12-46-16.exe	89
PID 1080 wrote to memory of 944	1080	aJx1NIFv.exe	8
PID 1080 wrote to memory of 944	1080	aJx1NIFv.exe	8
PID 4928 wrote to memory of 5472	4928	regsvr32.exe	93
PID 4928 wrote to memory of 5012	4928	regsvr32.exe	92
PID 5472 wrote to memory of 2548	5472	cmd.exe	95
PID 5472 wrote to memory of 5640	5472	cmd.exe	96
PID 5472 wrote to memory of 5936	5472	cmd.exe	101
PID 5472 wrote to memory of 5112	5472	cmd.exe	103
PID 5472 wrote to memory of 3392	5472	cmd.exe	104
PID 5472 wrote to memory of 4352	5472	cmd.exe	105
PID 5472 wrote to memory of 5844	5472	cmd.exe	106
PID 5472 wrote to memory of 2568	5472	cmd.exe	107
PID 5472 wrote to memory of 2276	5472	cmd.exe	108
PID 5472 wrote to memory of 4708	5472	cmd.exe	110
PID 5472 wrote to memory of 3308	5472	cmd.exe	111
PID 5472 wrote to memory of 4840	5472	cmd.exe	112
PID 5472 wrote to memory of 480	5472	cmd.exe	113
PID 5472 wrote to memory of 1068	5472	cmd.exe	114
PID 5472 wrote to memory of 1648	5472	cmd.exe	115
PID 5472 wrote to memory of 4068	5472	cmd.exe	116
PID 5472 wrote to memory of 4260	5472	cmd.exe	117
PID 5472 wrote to memory of 1568	5472	cmd.exe	118
PID 5472 wrote to memory of 5812	5472	cmd.exe	119
PID 5472 wrote to memory of 5648	5472	cmd.exe	120
PID 5472 wrote to memory of 4080	5472	cmd.exe	121
PID 5472 wrote to memory of 5988	5472	cmd.exe	122
PID 5472 wrote to memory of 5128	5472	cmd.exe	123
PID 5472 wrote to memory of 3364	5472	cmd.exe	124
PID 5472 wrote to memory of 3760	5472	cmd.exe	125
PID 5472 wrote to memory of 3816	5472	cmd.exe	126
PID 5472 wrote to memory of 2256	5472	cmd.exe	127
PID 5472 wrote to memory of 1496	5472	cmd.exe	128
PID 5472 wrote to memory of 3032	5472	cmd.exe	129
PID 5472 wrote to memory of 4088	5472	cmd.exe	130
PID 5472 wrote to memory of 5320	5472	cmd.exe	131
PID 5472 wrote to memory of 1692	5472	cmd.exe	132
PID 5472 wrote to memory of 3416	5472	cmd.exe	133
PID 5472 wrote to memory of 5980	5472	cmd.exe	134
PID 5472 wrote to memory of 4808	5472	cmd.exe	135
PID 5472 wrote to memory of 4152	5472	cmd.exe	136
PID 5472 wrote to memory of 2404	5472	cmd.exe	137
PID 5472 wrote to memory of 2492	5472	cmd.exe	138
PID 5472 wrote to memory of 1336	5472	cmd.exe	139
PID 5472 wrote to memory of 3236	5472	cmd.exe	140
PID 5472 wrote to memory of 1256	5472	cmd.exe	141
PID 5472 wrote to memory of 2592	5472	cmd.exe	142
PID 5472 wrote to memory of 4672	5472	cmd.exe	143
PID 5472 wrote to memory of 3636	5472	cmd.exe	144
PID 5472 wrote to memory of 3292	5472	cmd.exe	145

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:944

C:\Users\Admin\AppData\Local\Temp\image_2025-12-31_12-46-16.exe
"C:\Users\Admin\AppData\Local\Temp\image_2025-12-31_12-46-16.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\aJx1NIFv.exe
  "C:\Program Files\\Plutdroument\9FFCfi1u\1upDAF\aJx1NIFv"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080

C:\Windows\system32\regsvr32.exe
regsvr32.exe /S "C:\ProgramData\Roning\goldendays.dll
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\cmd.exe
  cmd.exe /C ""C:\windows\IbqcjbebHf.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:5640
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5936
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:3392
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4352
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:2568
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2276
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:3308
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4840
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:1068
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1648
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:4260
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1568
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:5648
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4080
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:5128
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3364
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:3816
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2256
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:3032
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4088
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5320
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:1692
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3416
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:4808
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4152
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:2492
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1336
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:1256
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2592
- - C:\Windows\System32\tasklist.exe
    tasklist /fi "PID eq 5012"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\System32\findstr.exe
    findstr /i "5012"
    3⤵
    PID:3636
- - C:\Windows\System32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Users\Admin\AppData\Local\Temp\vmservice.sys
C:\Users\Admin\AppData\Local\Temp\vmservice.sys
1⤵
- Executes dropped EXE
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

H3lWKj.3v

Path C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\H3lWKj.3v
Size 2.7MB
SHA256 c497b58ff068c3ac21d3b30fef5af2c7d6182277348ad96928f7b28e410e862d
MD5 fa7298ceff285e62268fd337b532894b
SHA1 02ec8e672ee8900b4f155ac5503cf1655d808ac5
SHA512 b3c57acb73f11d6a2dc7f687cf2b93d7c949fda38f7f8e238869c783b3f81c6ba9055b46d914b961d776c1a1ea2dc6eea5f01405ba9f5afd17fabd759b020db9
SSDEEP 49152:Rj+ip4ZYYiHOK9YMcQxFfbiaiJrAfKXY9YpWE2aQNmdjLQw90xiAB+Ni:lNp4OYiuKmMcQPODfxpWEPQwdjLQlB+w
TLSH
T183D533204CEBFF15B64B3EB46665CD8C06C9350317EBE0BC59DDA78AC19A3461892E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsCamera.dll

Path C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\WindowsCamera.dll
Size 104KB
SHA256 2c11d0d86d014a3634cadd1b16a1f2c2aae008610e0d5be3092b55c4ca52731f
MD5 5dacff5861f1b62731412062a9bd44da
SHA1 34ee575cbce94a6170d1139ce4cd69edc16d40f8
SHA512 d46df216634fbd2adc39343e0eece109246e9356e7900c5b1430fb4bbda86f331c84adeb747c52d9b6ad4a403596a31599b46be7a744a8b39070644cc4b5f6d5
SSDEEP 3072:a+hi9tPuKAFPDXCEoU/OgCMblIfLoKXyXWzvCAj0gheC:ri9tqrvom8Rat
TLSH
T17AA3395B72F500BBE1B7823888530A499B72B8511761AFEF07A4465A1F277D08E3EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aJx1NIFv.exe

Path C:\Program Files\Plutdroument\9FFCfi1u\1upDAF\aJx1NIFv.exe
Size 20KB
SHA256 39f2721f8994cbdd3fdde18abca2ae2acf3781c0d8b7850276be9b3a40f1467f
MD5 985e0e502b93c0bfab786466847c9a3c
SHA1 07d7d38200908a9073d06928b8edc6f61fc59adf
SHA512 f6f3d6c553b140ea8b78e3af0a46b0c1f6c3268fedc53aa4f111605249af13ef3ec8a905a53bf0f2b5b2b48d13af5ce6af72a658b4e2fd7cec491a729a87f1dc
SSDEEP 384:oHFkVNncq9Z3ToTRvvB4GJvLa76a66NSwwtO0wsHGf2QorWQ7OWQf:MFkVNncq9Z3ToTRvvB+2A
TLSH
T17392D66013C48353F34367FAE635CDF8872D5A9B0D21985439CE224ABF5E5CE22A2D93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enpug.bin

Path C:\ProgramData\Roning\Enpug.bin
Size 170KB
SHA256 a696f2543cdfd0578f96d458816051e65ed25e757502ed190182e5f85ef522cb
MD5 786680a4c3714af139623b7ad67f71e9
SHA1 e41b1aea6db5918d48ad2db1b24fdb83a28859f0
SHA512 cc99dfdcef56663b486ff28f152f045a1cccc83af0d800128c8b6747652311d8f81fe6dd3cc12bda1371993a6a831107f5ea1a71d4d1b44ce98993e36a8efea2
SSDEEP 3072:tC+U7Tz+HjTejTUvs/Sa1DHt3p3makuDozRNd8suZ100oYd:tCzz+DTejIvuSkHtZdp0Fb7R0
TLSH
T187044946339432F5D46B8278C9924B17FBB27876477157CF46A482BA2F233E16E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goldendays.dll

Path C:\ProgramData\Roning\goldendays.dll
Size 258KB
SHA256 33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c
MD5 d920c1a909744e206405ec13539ee01c
SHA1 bf778f27c8abc9bd44ca484bf18d45cd17f7bbc8
SHA512 f0b30c2ea0dac44661f88b72861da1a25f9c826fd840b093ce36fa77be22856a3592c9e2c05e62a433fa2a294745c3aa923049ed0262170b078d95ea12f403b7
SSDEEP 6144:aKzJW4g+lZ1WJrfO6F89mJJSbznohoHF6nGj:PHgi1WJfOixvSfnoIbj
TLSH
T15F446B1972A50CB5E977823DC8535A06E7B2B84603A0DAFF03A0875A9F377D0A53FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trustinstaller.bin

Path C:\ProgramData\Roning\trustinstaller.bin
Size 142KB
SHA256 fc63f5dfc93f2358f4cba18cbdf99578fff5dac4cdd2de193a21f6041a0e01bc
MD5 00893b7c3e8c39d4663257ddec678aa9
SHA1 97e2a79af66c94fadb0f039fea405c1e612d6729
SHA512 dc324c1a84f3b8e7be18659ca5e589feb7bf9b91d1c3e962620186eecaf210955dfe44b893d51800e563d6d2d59d21aa841bf1b55a529e1a0db6e3ef6f595e4d
SSDEEP 3072:d8rLABJ/oXQJioZSv6Qgzsw90cGi6adqhI:JBJ/ogJiogSQgzsY0YU
TLSH
T106E36B57B7A530F8E5769239C8605602FBB2783647349B6F03A443661F233A09E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goldendays_reg.log

Path C:\ProgramData\goldendays_reg.log
Size 627B
SHA256 27da5d9e8d4df1e942a4c77610a3548a596008d5db9a5182eab3a689883741f5
MD5 06b45cc459fd44903728931269d4db6d
SHA1 ab2645a177a8abb41a926520aa6fe2421739532f
SHA512 281340613785bf9af962da44661227e618ebe1af138edba1ababb4b2416ce252fa7e765a77012f3c9821c7299f2a74f8a12d4a548b82b631ca4c6cace7ac980b
TLSH
T1D1F02285C8E4C1C0B32F75C363798B80329FAEAF3448A7986368DA2A70C1ED6474F4D5
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD6D.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvDD6D.tmp\nsis_tauri_utils.dll
Size 32KB
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmservice.sys

Path C:\Users\Admin\AppData\Local\Temp\vmservice.sys
Size 50KB
SHA256 627169b1bad0744f636c72a86f6f8e0ff1f4fbb475e8629576a2462a0341ca4f
MD5 5b3bea02989eaa3c91cc0529b28c0fdb
SHA1 8b938dda75e9c72be2e34be0a3fd855b09d780c2
SHA512 5d983c0fe38daed7bab4904dbce99d765119e4a96464b67aa887b8329272f1e1a7168ff70e5cc0512c4ab1a5f486cba8fdde8792d49cad5cb7d8b2e688bf84d3
SSDEEP 768:dnqcG6aNG2dYzLlhrO5YB3f0wXNEuLSoQu7aYzLlhrO57qW:dgdYl5pewXpL7uYl5JW
TLSH
T106337EA28A146CD2FE579E30E1D88627EEB1B2822F5189CB2114C5D91F837D53F7C25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IbqcjbebHf.bat

Path C:\windows\IbqcjbebHf.bat
Size 299B
SHA256 4f45a7b316f6cafe6cd122cb4025ccbaeeea5115e88076071dea86a8a35b4f02
MD5 9525c3a461428d037821b601d3b954e5
SHA1 18887f70dbdff8cdba6b8775b0b20fe09dae80ab
SHA512 d1de03f5daba87e032ec3256e11875004b2411213309c5f27cb17d03e8e76d3aff9b9d057a79a6c71e5091a725917610116e13bf4b4863d21bf23fa532d9b77b
TLSH
T1D2E02B1998D9DB335328412B2A2F9550F44721937F0014B8706DB7F94B0F9538AE80D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/944-48-0x00000165EFAC0000-0x00000165EFB3D000-memory.dmp

Download

memory/1080-38-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-34-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-32-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-31-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-29-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-30-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-43-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-40-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-35-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-28-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-45-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-33-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-36-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-84-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-37-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-39-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-82-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-44-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/1080-27-0x00000290BD9D0000-0x00000290BDC8A000-memory.dmp

Download

memory/1080-41-0x00000290BDC90000-0x00000290BDC91000-memory.dmp

Download

memory/4912-79-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/4912-71-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/4912-66-0x0000024274970000-0x000002427499B000-memory.dmp

Download

memory/5012-61-0x0000018094D70000-0x0000018094D94000-memory.dmp

Download