danabot | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
172s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 16:59

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

danabot banker bootkit botnet persistence trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
botnet

Processes:

resource yara_rule

C:\Users\Admin\DOWNLO~1\DanaBot.dll family_danabot
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

76 4636 rundll32.exe
78 4636 rundll32.exe
79 4636 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

WinNuke.98.exeAgentTesla.exeDanaBot.exePetya.A.exe

pid process

2476 WinNuke.98.exe
3100 AgentTesla.exe
4824 DanaBot.exe
5060 Petya.A.exe
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

3640 regsvr32.exe
4636 rundll32.exe
4636 rundll32.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

66 raw.githubusercontent.com
67 raw.githubusercontent.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

Petya.A.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Petya.A.exe

resource	yara_rule
C:\Users\Admin\DOWNLO~1\DanaBot.dll	family_danabot

flow	pid	process
76	4636	rundll32.exe
78	4636	rundll32.exe
79	4636	rundll32.exe

pid	process
2476	WinNuke.98.exe
3100	AgentTesla.exe
4824	DanaBot.exe
5060	Petya.A.exe

pid	process
3640	regsvr32.exe
4636	rundll32.exe
4636	rundll32.exe

flow	ioc
66	raw.githubusercontent.com
67	raw.githubusercontent.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Petya.A.exe

Drops file in Program Files directory 10 IoCs

Processes:

AgentTesla.exe

description	ioc	process
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll	AgentTesla.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

220 4824 WerFault.exe DanaBot.exe

pid	pid_target	process	target process
220	4824	WerFault.exe	DanaBot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 5 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 459826.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 683833.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 620436.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 653965.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 185936.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
3944	msedge.exe
3944	msedge.exe
4736	msedge.exe
4736	msedge.exe
1320	identity_helper.exe
1320	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
816	msedge.exe
816	msedge.exe
4108	msedge.exe
4108	msedge.exe
680	msedge.exe
680	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid process

4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Petya.A.exe

description pid process

Token: SeShutdownPrivilege 5060 Petya.A.exe

description	pid	process
Token: SeShutdownPrivilege	5060	Petya.A.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

msedge.exeAgentTesla.exePetya.A.exe

pid process

4736 msedge.exe
3100 AgentTesla.exe
5060 Petya.A.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4736 wrote to memory of 4808	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 4808	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3980	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3944	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3944	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 464	4736	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e5e046f8,0x7ff9e5e04708,0x7ff9e5e04718
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
2⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
2⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6244 /prefetch:8
2⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3364 /prefetch:8
2⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:816

C:\Users\Admin\Downloads\WinNuke.98.exe
"C:\Users\Admin\Downloads\WinNuke.98.exe"
2⤵
- Executes dropped EXE
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1980 /prefetch:8
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Users\Admin\Downloads\AgentTesla.exe
"C:\Users\Admin\Downloads\AgentTesla.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
2⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5712 /prefetch:8
2⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:680

C:\Users\Admin\Downloads\DanaBot.exe
"C:\Users\Admin\Downloads\DanaBot.exe"
2⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@4824
3⤵
- Loads dropped DLL
PID:3640

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 460
3⤵
- Program crash
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5708 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:1
2⤵
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 /prefetch:8
2⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,5315454204580652140,1478753757149375098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Users\Admin\Downloads\Petya.A.exe
"C:\Users\Admin\Downloads\Petya.A.exe"
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4824 -ip 4824
1⤵
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
2033a4d6f204519877b5b2e23a8d7017

SHA1
e22041b3396e81d2aa3a3caf3c96d55710292b06

SHA256
105fed0dde792f3cba6defb88040b1a56c92a10dd1be069aa1f12e9092b02c3a

SHA512
11cb1d1a279345dceb3df84abd676774e26477db1862f7672bab3b6bcf34e38f0c3605823eea2209c36e4c906b62fd25300bfeb5c6f2d59cdbb34d29a96977ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
8a3fb93bef1b303f27d91cf8b61af384

SHA1
d163ee98ebf0a8c9a1655a906eabf3c06311ffbe

SHA256
4456b0e01e4b98d9abdc31d1ae6a0e47c0a61b288b046d6428880a6d07b887fb

SHA512
ffa7dd681dc82414e5c3ec614cc5fc620fc46ba1d29a2c4190975bb7d44dceae53aacb6655501dc5fcc96af6117b4ea6c7b00156d429085d1359139f96cfe6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d2b98679943d286551439febc3d6cb60

SHA1
6eac8144bf976b78cf82e7c65af505cb0422a28a

SHA256
da903dfd5206789b203e9cd24f1a61be2cfc0229a0fbfa9085e478d1eb88cf8d

SHA512
9281d4090b7b770d0430bb1e3283359278698f309f68a0c8cd6a8347de7af5fdc93232e89e322e6721739863f62099b2b722721965668b4d4598df020d6b8bbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1290c5b69c8e167a74e3a54636d00fae

SHA1
7aae8b51418955f1baaaea22c49a82e2ca35edfe

SHA256
0df149148a9afaf6729e644416d48209168e85ef224d104d8dd055177ebdc598

SHA512
49f9ee0d8e87858706009ee859406ef26483ac2911dedb4c6398e9ededa9e9d4502fefdd3f1f332e67c72a1f55b88dbb95c2ba2aaa1d2d28776d7e0b56e83a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5c29271465b0873a47903c1663c3823f

SHA1
c179c2218572f87b1671d32db7f807c304c200a8

SHA256
c478b2c8fba0ad53b47a27b1e3354fb7038f892053659faae2bdc454d780ee26

SHA512
a5f9e9939cfe2b216f4d4e575544558288a2faafca3e4bbc990d6b6fab2573e179eb9139e840603da873aee4afd1c4a5d709a332ba4cfb7994135c7ceef367c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
29c79297760dc7d32b294610d06993ef

SHA1
3c3811fcd9a37f7517556baaa5f5d24efedcbcfb

SHA256
1b78428ce4f94c95498565dfb1d661e1fe91391d75d0d688fe0fd7bd8f57142c

SHA512
9c9bf69a4a358eba062772460364c0faee88b032a61adc27b8b9be95a2bdaaa3162bdf051ffdd72a70919be9156c1a8bc70f3c1c940e781803d2426a260c5b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
24cd8c81f1e27b7af666d77986c36d84

SHA1
bbe31a9b5ed5f179c61c2c583d2a155cf0d590be

SHA256
347a81df28bbc8cd0c6d0a7e057de33d72059a815b753ca228cbd813740ef171

SHA512
c8eb62a1186c57f7ba9bf2501f38c94562737d36c991cbf14e3011d26f0b5254219ba65a4a86e760fbec942593bec164f874004fadeab1b04c879a3501ba48bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ea7b4f73c4821a280569b96a407a1afa

SHA1
29e17f4e3d6297e0081f07b2080b5db4a1eda0d2

SHA256
cf5a2f30d52af3de30dec40e12fc5a87dd86cc94eec56270b261fdedb77e3341

SHA512
9862f9653882c41105f142b6b067d714785c3974733a2bf2faedc0efbef88b28c2bdf76d6fb08a8727b76d8ccb0f81e9b320051753bc9a3ddc5b3b6376462a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
6bd91de885c7bc2cf056d9eb583bab82

SHA1
a8d6bc90ce6ed51135c18afc0630aadcd377599f

SHA256
cf8204dfb5b2412c7b55412d0c47d39cf88b0f2119666ef35500cc1271f0defc

SHA512
9dc503bb15765e9942440b2d48f713036ff317b930158c49a25ddaa154b89eb9227fff7f33b70e26d683ce62e58337c9beba3b49ea554cec4275f29733611706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
0d11218d8b7605f9cf50f7edeee86469

SHA1
8ea9c2506d16d863860eeef7806e91804cfb3066

SHA256
c2f6806b7d50690013e3ef9bcd3fce1101ac471ea5ab5258547178bfa5549678

SHA512
2ccace9d035b3014a9fdb52638fddbec008d95dfcda88c3b5736532a446c53e90a3c2bf9748ac4fb03c6a284023cff00df68a6354d3a1f814f84cca9f6d78dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
c406765067e9443d63e97309d37ea5ef

SHA1
2c28e7dfa5445afd110df268221b0fc8376d4e97

SHA256
5bc016889d0f401de50741672ce88e4a6e77443f08b65a7b110f4000ec808aa0

SHA512
93b0786a6d70490bc1609f554722cd67aea1536a3b71b1c6965edabcd83054672616c7a62d473c28b9948180b2e5e78c9de7ad1a53d73c065ca964693c404e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
150ade466520999c24169e21d5b36928

SHA1
8f5acae23ef3c8d0c861222b051fe6dd33a9ffef

SHA256
7cbe3a2c4a4e8e28e74b658b68d0c23daf781dee98425d4700629d0c708a7f55

SHA512
53a0af5c543cacdbee48db0af2018fbaddea0fde2648c58bcf4c5810c5a8c7574fc097dcc75285332db317edd9d6970df512ea731790e5b1bdc438a0887ff8be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
d00bf6afabd95ff7e50ed9626cd3b523

SHA1
cfbcaf2bc4a2c2f9ae2c0cc30ac161d07473a615

SHA256
83df1d569af6ce25f1fd3c2a5624c001c250164931ab7a83f024a374b651dad7

SHA512
50cba05b16acc762eda433fdad427cde3ad1b487ef440fbb94662abd3cbb9c85845f0dffe361a24f04b90fb3d6e63cd80078c8f8898199a03828bb9ac0d6dd86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
66ab5579da7b852cee8e2f676db59d8c

SHA1
37db21c260a7096a08a9a8755a2054eb8e00b6a1

SHA256
4353624ffbac5e1c6c6f4c29f42e1585ce833c507a9904fe365d937c726ed1a0

SHA512
eeea04d19fb482a2f5209f51a597beecaf748024a8befe3061093239ad68e49a4d2402b5ee17d200ed4611b27c694796d5d6e39272167b6498255f706f663f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6c8.TMP
Filesize
874B

MD5
2e5f4ac536fe15f1f26c349baa5f0c0a

SHA1
9024184c3c57cf3a1fe1719f418ecb85baeb7210

SHA256
f23841fb4365ff1bb8244cf9873ee02fc3af7cff0b7d02f4fffaef106d29a067

SHA512
02d1c32968837fe1a9154fcc9a9b3cb6d77922042bd3b82090f0b4dee41bda4bc09e3ab7844a98b6086beb9aca6b8d7546b896422dfc4bf377e3c7fc1103ad8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
88e43ec34c1b4587204340429d65e5d7

SHA1
bba6aa2c4ece8940c084756a40a2ddbc9abbaffa

SHA256
20125e4452fca138f0bd22c24258490da5f79c54b25f0670bb9cf543f354b1a4

SHA512
c0f9e4a38b4a15c6cd3d7ef6daaa5233cc835692ae8fe963e54ba523359190645fd9d4b5484d38a1cc6deb6314a7f4b5aa5816bb4e0d6a25ff8fd4b6b0863d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
f85fdb1c10bcbdf90ea0ae526a0e8170

SHA1
504bffc5e29bf79ae12bcf7e2006a5847e5ecb25

SHA256
c0cda0021d312eb25771303fe8ac2a0e0da9182d64a4e65a6a3a14e3cf24d73e

SHA512
dd2b190d6b201a27fb6eafa5e1d54c28a063ccc0c426840d7c4bd2782472ca6ba1db2e5bd8958efc40e1c450b8680a4018774f6fccdbae9005b2cefb9d5f5b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8879fd5872160c7d67f22a71aea28b50

SHA1
d3a1f8ab6f97953952798e66ffebda1e1e63bf8c

SHA256
dd7e09ae021d331b9517d4992543579bd60ab93257c719cd0b32ee1f8369a681

SHA512
bc1b4108615ed61a89e42fd2e5defecd685bd5c28f641c6604b72ad0376b892118f39bed36cd8e046435ff721dbe3958581ee070f0976358389e47fecf40341f

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll
Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 185936.crdownload
Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 459826.crdownload
Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 620436.crdownload
Filesize
225KB

MD5
af2379cc4d607a45ac44d62135fb7015

SHA1
39b6d40906c7f7f080e6befa93324dddadcbd9fa

SHA256
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

SHA512
69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 620436.crdownload:SmartScreen
Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 653965.crdownload
Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 683833.crdownload
Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
\??\pipe\LOCAL\crashpad_4736_XTSQVEKEQYUPRFTW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4636-531-0x0000000002030000-0x000000000229B000-memory.dmp

Filesize
2.4MB

Download
memory/4636-510-0x0000000002030000-0x000000000229B000-memory.dmp

Filesize
2.4MB

Download
memory/4636-485-0x0000000002030000-0x000000000229B000-memory.dmp

Filesize
2.4MB

Download
memory/4824-495-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads