05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Size 10.3MB
Sample261110-vghv8agh98
SHA256 05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804
MD5 3608ee3877221565ce9c01d9967798ac
SHA1 9d21be7c1bc2d5aec348b455333a6dc5a8480e14
SHA512 e61cf04a853c4b4536a938784ce9c786a4d4abaf31fc217c8f10816d90b407dc2aa02a1217b09101627095f4937db8d023a84c30e57670730e231a0a251716f5
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDyg:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8J
TLSH
T100B633EA786F6ABBC10D0C398D0A8D6235BC6BE187644DD3FFD57DF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	CoreSystem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WindowsShell.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3120	WindowsShell.exe

Executes dropped EXE 11 IoCs

pid	Process
4084	WindowsShell.exe
3120	WindowsShell.exe
3240	ServiceHost.exe
5072	ServiceHost.exe
3084	CoreSystem.exe
220	CoreSystem.exe
1244	SecurityCore.exe
1264	SecurityCore.exe
3560	UserSession.exe
4796	UserSession.exe
2464	CoreSystem.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\CoreSystem.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\UserSession.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\CoreSystem.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsShell.exe\""	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\ServiceHost.exe\""	WindowsShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
135	raw.githubusercontent.com
161	raw.githubusercontent.com
100	raw.githubusercontent.com
103	raw.githubusercontent.com
149	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
74	raw.githubusercontent.com
123	raw.githubusercontent.com

Custom signature

Detect suspicious telegram bot 6 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024326-29.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002433a-109.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024343-145.dat	suspicious_telegram_bot
behavioral1/files/0x000200000001ed81-154.dat	suspicious_telegram_bot
behavioral1/files/0x0009000000024343-212.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000037-246.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UserSession.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ServiceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CoreSystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
4084	WindowsShell.exe
4084	WindowsShell.exe
4084	WindowsShell.exe
4084	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3120	WindowsShell.exe
3240	ServiceHost.exe
3240	ServiceHost.exe
3240	ServiceHost.exe
3240	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
5072	ServiceHost.exe
3084	CoreSystem.exe
3084	CoreSystem.exe
3084	CoreSystem.exe
3084	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
220	CoreSystem.exe
1244	SecurityCore.exe
1244	SecurityCore.exe
1264	SecurityCore.exe
1264	SecurityCore.exe
1264	SecurityCore.exe
1264	SecurityCore.exe
1244	SecurityCore.exe
1244	SecurityCore.exe
1244	SecurityCore.exe
1244	SecurityCore.exe
1244	SecurityCore.exe
1244	SecurityCore.exe
3560	UserSession.exe
3560	UserSession.exe
3560	UserSession.exe
3560	UserSession.exe
4796	UserSession.exe
4796	UserSession.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4084	3388	05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe	90
PID 3120 wrote to memory of 3240	3120	WindowsShell.exe	96
PID 5072 wrote to memory of 3084	5072	ServiceHost.exe	101
PID 220 wrote to memory of 1264	220	CoreSystem.exe	106
PID 1244 wrote to memory of 3560	1244	SecurityCore.exe	107
PID 4796 wrote to memory of 2464	4796	UserSession.exe	110

C:\Users\Admin\AppData\Local\Temp\05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe
"C:\Users\Admin\AppData\Local\Temp\05ac9330201c277c6ae317d657a15a6fecc329d74737e8b2f083ee5cdf020804.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3084

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 280B
SHA256 d715bcb4b19603107a525ed1f402809d9884464f985e6fadb258be7065db3610
MD5 0b22d6d944fcc7a7083bbba21522574c
SHA1 d55dd42499ae4671c74de7d9086b3137da7b10df
SHA512 42d7531e7f9b19bce718d65cfdb1cbd3db79d7b98a299d47c5226428a323400082d02325f2b0b5a967edc5ac2fa22e557bd2cb742dc7c0b9ad6694909b297e3e
TLSH
T137D02B0E99F579437D23C6109594D526701314741BE0A228AC24C32AB825D3F1F25120
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 311B
SHA256 58d1fcf9271a586bfbfae53b7c3ff43bba20dcdcd44f08a483a57025b4ba6827
MD5 d6037eeb7409b26c7c641f29bb8efc40
SHA1 646146d85aab585ba4289adbf05e1d2263df693d
SHA512 bbaa440b984682032a8ff249cc7bcd5b190a5661ef3d36f66ae3f864586ae9b0a745878cf4d8117a5b8039efc094a24a0a0d71199f78e813cefa0f79d34cd8a1
TLSH
T1FEE07D22E73C99C47221992C0F66406D7890011D89A4495679385BC54D463BB840B01E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 3ad2ab88c78173824f34c3a8f78799a983e7907c17a767cefe92ec736b0017af
MD5 6a0ff8a73931feb880e25718580f7475
SHA1 ed3109729892632f8fc408733f0bc5f844cca891
SHA512 b75bac4bd8c5df6817f78a1fccd7ed97e2047ce4bc85622e09915298c09bd8354bf3992fae05e9ea7b8aa5b4cffcc3e90d6a3463aebd1ea8852fe987973c2dc7
TLSH
T1B441D8DAEA5C3064BF869F40593CCB362C78B291A688645571FFC8F230D6BE42D1A85C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 236KB
SHA256 000d26ce6e3e1fc87a4b6e928ff9d67679707fca4a3b980e7375c83d168de885
MD5 f970393956cc729ee2641a01da766e9f
SHA1 51058fecb67e7152860ade2706737d5e58858cbf
SHA512 196cf30d201c336deefaa093ca8046fde4d356a64b8963c60de5fb481fa6a7b77809fcd407eb4a9c659091dfec36140e90716a7c222ec448f8ba710c2d3709df
SSDEEP 3072:M7MKLRCV+6E3+bCtYuiRGTVzDZaJuJ1sGONRjBm1CI8S2as2O05a4:M7MKLM+f7+2zDZwU1m9m1j7BsW
TLSH
T1BB34EE589DB7F0665E8A9D618CD79E8E47F031DB2342621B4EA35FD01C17BDB8E6208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 eb5d684d6c9c1fc72b425047f74e1d6ad36b190cc81f6cbfbd044bcacb132fb4
MD5 4f4bfbb0768dd4b6571c76bdb9d2da30
SHA1 50284555eecb59c80a8d5559160748c6c5d986aa
SHA512 e18e5f694cd0117533c32351fcf24415ea7135fc7caecc7561b03f0442f3e8255d02be82aecd3fb8c58a8b6020883a20f12c21c6d912ccea501a557416a56127
TLSH
T1FE1154C2DFE8F1819AE257B1CAE8D5267CB464D52DEA70C16C90C8D2349A75E3B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 3f13e844dec517f1b5ee52ea4bacb23645885531067da7597df44918b2655152
MD5 8b154fa94733b466b201660bbeb080b9
SHA1 f9a19fdad45c39998a381f630b4b10f23dadd918
SHA512 c0e15be1563d305e47820f6ca8b905115b447041ad4f45c2d92870c7203881826dcc6fa7d5e0e680f4162e74a7fad53b6f201184bcf95f8f0d67e3292891a418
TLSH
T15541F8DB9F4D7878EF42CF8B2DB6C47A2D78847490810885B5B7C9C221EEBA6690945C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 52d686dcbbbb9152d1401de1fcf88f0a524e833cd4b6f079d2cec2a582faec9a
MD5 aaeb4d4a5b546661e93eb8d60c79a6da
SHA1 7aa4689cef3d66f46a1557daa8f0f51db79b237b
SHA512 95ed91a2f14d5a14705057ea4d8adcdd0185179024ea063943e770300a5dbf6f733c523e34f42e34db0423d55fd38ae4a2f527b4cd6f2873b14f076af852f652
TLSH
T151F0AB2405BD021AE43AE87982E57D75AC1EF6253B099BEB1BA20605AF26E500EC112E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 effe61f21d4d09cc719561ca0f95040ea216b6e40a479663662e289b37b063bb
MD5 348b6ab459f9635dd44ea92633a0321c
SHA1 c47937936e153571ae7cbe958357786132486628
SHA512 12606c6d6f1dc5753d619c74784845420a7ce9b22469c151fa17b2b7104fee69be7bbd86b2d7779e0d55c01bed618d3b93407385711b47c6cbd8a9aeb8c8234d
TLSH
T1E6C0801C5D510505F1A8437C01C13D4357104101E241CF0516F53504C95AB157834C2B
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 fc9bbb2167ebdbddc439ed6df7a16d9e936d91d8c53315e5bf8ccab9a8fd22ee
MD5 d4c41bc6e02200e20634c2e87ad74bcf
SHA1 aa60e68dcdee0cfa1cc1fdd68d87723bcdf9ce07
SHA512 7a439ee8a13de8dbf280b5e95bcede23fe133ce2ec4ceae8dbfa719f7cf40cd4ee14d0e2ea5be8266a6dee571e46898403e75f97986a885173e4d0b85b968d4d
TLSH
T103F05C3D16FC843EE272DFB8CED4A7D6A919F237340842D91692474C9A02B052CA162C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 249903e2c820f6a30d63d95e9c57b0cddb864262a9d25b7c1f6879aeb493f65d
MD5 ec1c650c9988c4e89c911ed93677361d
SHA1 bba2ab8a345434a2ae3f66c81b43d7fb3bc17c98
SHA512 14c38838f07c54e66ebd997d910fe771b9dfdc1ea11c955a82b6f267a6d5007fb38388dc03fed8825b35bf81f5a8b3f468db0afaf37ae77235195416ba9a11f3
TLSH
T1F2F068543DFE613FF277F938C3C530710C37E31A6006A6BA1AB053086A26E222C6192A
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 db441231346fb6e238c1c66e295e07f8b8781a7150c0bda33eea8e4f71dd7b07
MD5 3273796e652b68d6ee2ab788235d44c5
SHA1 14f5a08e0fecace8e7371aca502682b1620511c7
SHA512 c606ba8bdd4784cbdce044ac42ca6b1a158c12020b53d57141582f2feba5d57e465f438d42768bf75eba4ab3f922374e3b2b10c129b8387ed610aa77697f3779
TLSH
T1C0D012283F91423DF03E92BA1874595BBF903126B1E2C74D1F76150C891CA104DA1C0E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 242949a9fca260dd57d5d2c2be1398e9e95fa2bf630995ee2308ec2fcd038992
MD5 4a50a001f7c99ec08cf1a6e4300a54e1
SHA1 6f2d867113fd5052e9c9165832ce5414c3129018
SHA512 fea19965196f2b53cafdef9c87b6c2c0c871afccb72d2ac93d40f522e8e473b2781cd0cc00d5bd44aaf5725f6da9af31539a07f4ac65ef22847c248a4d02ae87
TLSH
T1F4F0AB1456DB502EF672327982F9639EED15B2A63401C4AA1B9B134EFE27E801D1153C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 73708f6b923fdb52106cf424e550b35075ca6415c4eaf5a95583928f8f29bb5b
MD5 e1c506000d434c7281a74d2368453487
SHA1 b6bb9c4ef8cf0bba234e727bd326656b87ebf161
SHA512 81c1a7d3362fac7dc953bf5deb57f6ae50b4891f8ab6265a492033865e70ec6602594dc7b544a7784d8f7017aafd86585cd9d0057e9ff19616a252872a370e00
TLSH
T15EF0AB3528F7122EF3A2CA7C42C552D60662E13733063B69377182095E0AB40AA30D26
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 56528c3cc3afada795619bfda769e210a9cf099535ad92357d0017e9a340b992
MD5 e1e98f3a220dc756386e45b82ca0cf2a
SHA1 c99c30c3c3dd9eb8ca06d473ad5d934ae20f7a77
SHA512 8b279acf485e5fc0e807d4cdc4b50a912ffa7ab106dae55a7a32bf690e79acd7c03860a4a8cb6d8ed33837a0ec3f72766802d4cebe3455402ebc8b6ee76d93b8
TLSH
T182C08C1C46610606F2A883B802C23D838A228110F382AF0226B13A08DE28F122834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\UserSession.exe
Size 10.9MB
SHA256 026cd50dbf09e292db7dd7ac9c8fff4840c089f339635b6b097ce6ae704fd073
MD5 d60b8a9748dae53de625e2fe151ea54d
SHA1 754ce9a331d06a48c5b6b0ad2a20a96eaac27c5b
SHA512 650edb9943c75f7ab526eb0154950e28faa080edeeb48517f789ce2f3df7364b43363808b43d9ccd89fa4093127a3a23976f7346e2bd03cae05cf4b337a5d014
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDy7ye:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8K
TLSH
T181B633EA785F67ABC10D0C398E1A8D6239BC5BE1C7644CD3EFD57EF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 10.8MB
SHA256 5b5fceb827cfec656d3cfc56c9c1c21a6b2c40b520a770de89a16f37eff5f55c
MD5 b1d90c284a7c89a5d142b5c97e539d16
SHA1 7510989f11459e7ebc94f73cd1ea3400751d7d0c
SHA512 45e4728534c54afdb992c6aed74647866b41bc8f818b98beb178047a7bfb598a6cc52d49bc8996ed1c9c1a7263aa3d6ee48607657276f4a35bd21f8ee7c4a312
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDyc:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8f
TLSH
T167B633EA785E67ABC10D0C79CE1A8D6239BC5BE1C7644CD3EFC57EF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsShell.exe
Size 10.5MB
SHA256 009f0aa4d7b60882785b8c1f59a7651f8c88edc895de9423d9f946140fe15b2f
MD5 295a3552b603bb2876ac70b77e19096f
SHA1 d8ca9c71b19eb7be550831237772c0240e85c689
SHA512 bd116e4eebf4c3da6e6684cb35035500bbdb507c3802484e695bcca7f1ee92fe06b4ac4e04e0d52f9137ba89f3b20bb4392cf888bba47fb2bc4d06189208a2e9
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDym:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8H
TLSH
T102B633EA786F6AABC10D0C79CE0A8D6235BC5BE187644CD3FFD57DF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
Size 11.0MB
SHA256 7c8b736b44b9ae1a8014beae83e7822322281ceb2e89a04c5b308ce1135dd127
MD5 0f464422e8c79cd8e8a09d43c3631e16
SHA1 7f001646e253e6c41b701d748f4a5c02b3822dbc
SHA512 bb819406e6e666bfda8d662511c4b11b0da7bec51323d7d543697b1065971f16888b77f52cc792ab4b462c246b85dfd87c5b776c9ef4332965507c221de798bd
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDy7yyx:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8s
TLSH
T1D8C633EA785F67ABC10D0C798E1A8D2239BC5BE1C7644CD3EFD57EF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
Size 10.7MB
SHA256 391cdf2c970dc5cbd68b75327859de2c75ca475b1c202da848070363fa5d54d1
MD5 95e859e91f31545a4039d118a57ba706
SHA1 e00d5eabf2f775ee8dd53d0bdb4f7637deb44b21
SHA512 3c7eabeed9bd1041589a49b07a0274e7ac0ae96cb19f8ceaabcbea4c750cc322c93d3aad578daaf8de5bec4fc4eff4c651f6db292947568a9f506b8eaa6ab341
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDy2:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8v
TLSH
T1B5B633EA785E67ABC10D0C79CE1A8D6239BC5BE187644CD3FFC57EF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\ServiceHost.exe
Size 10.6MB
SHA256 a629fbbad4bcf5f728eb88bbcb444922f2195e1039ab16ecab1e9511afe1a037
MD5 1d8cea6732ee6ac78953e33467e7acfc
SHA1 5918c210a45c22fd9954d17a36588ba11cc5a06b
SHA512 775d49c6dbbd557a5380972fd99bd62857b8a2640f5ec05866768ccdf923a349d9b6284387317a0cb2cc55f4b8f6a43c335263dc9f34eb6ee1be4b2f031b0106
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDONYxGuIBVy4874lzNLI8AqSaDy4:TDpbgBr/4QAMQMrEGRONY/4VLjlBLI8H
TLSH
T110B633EA786F6AABC10D1C39CE0A8D6235BC5BA1C7644CD3FFD57DF61840C522622927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download