Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.997649513723125
Filename:	LEADER_Setup_2024-03-01.exe
Filesize:	17423501
MD5:	cec0e50f9de40df587f87c062196880e
SHA1:	3493a1598d40e1895d734811fe5d3bd139c336b3
SHA256:	8a08fb3ae29464fe20a6e9cb38bdaa1a32c5ffb1812b43889f2ee6f403f7a7ad
SHA512:	4f295fa51bc3245aacfecf7c46c6faa18e83b581969bf19eac825a2d8377cedb2ab115d3ce2ff283fadaceb3dd7407f44f3dca835900abb706b5ed275b965acb
SSDEEP:	393216:Mjo/OwH5TLwbHgLcIxkFmYmYJg5DSkySmBbI4355/wB:3mwH5v+gI1FmYRg5DSY4X/A
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d.....................................V.......n.......V.......Rich....................PE..L......9.................".........

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Extra Window Memory Injection
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior	Extra Window Memory Injection
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion	Extra Window Memory Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Registers a DLL	Data Obfuscation	Extra Window Memory Injection Regsvr32
Searches for user specific document files	Stealing of Sensitive Information	Data from Local System
Uses 32bit PE files	Compliance, System Summary
Creates files inside the program directory	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Extra Window Memory Injection
Enumerates the file system	Spreading, Malware Analysis System Evasion	Extra Window Memory Injection File and Directory Discovery
PE file has an executable .text section and no other executable section	System Summary	Extra Window Memory Injection
Reads ini files	System Summary	Extra Window Memory Injection
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading Extra Window Memory Injection
Uses an in-process (OLE) Automation server	System Summary
Creates install or setup log file	Compliance, Persistence and Installation Behavior
Submission file is bigger than most known malware samples	System Summary	Extra Window Memory Injection
Found installer window with terms and condition text	Compliance, System Summary
Uses Rich Edit Controls	System Summary

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0019.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH001b.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH001d.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0021.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0023.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0025.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0027.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0029.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH002b.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH002d.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH002f.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0031.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0033.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0035.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0037.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH003a.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH003c.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH003e.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0040.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0043.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0045.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0047.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0049.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH004b.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH004d.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH004f.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0051.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0053.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0055.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0057.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0059.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH005b.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH005d.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH005f.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0061.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0063.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH006a.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH006d.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH006f.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0071.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\PROGRA~2\LEADER\Bin\~GLH0073.TMP (copy)
Category:	dropped
Dump:	temp.0000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DAO2535.TLB (copy)
Category:	dropped
Dump:	~GLH0002.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\~GLH0002.TMP
Category:	dropped
Dump:	~GLH0002.TMP.0.dr
ID:	dr_51
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	data
Entropy:	5.10364614190387
Encrypted:	false
Size:	73184
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the program directory	System Summary	Masquerading

Details

File:	C:\Program Files (x86)\LEADER\American.vtd (copy)
Category:	dropped
Dump:	~GLH0075.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\Filecopy.avi (copy)
Category:	dropped
Dump:	~GLH0064.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	RIFF (little-endian) data, AVI, 260 x 40, 10.00 fps, video: RLE 8bpp
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\LDR.ico (copy)
Category:	dropped
Dump:	~GLH0065.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows icon resource - 4 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\LDT.ico (copy)
Category:	dropped
Dump:	~GLH0067.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows icon resource - 4 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\LEADER.ico (copy)
Category:	dropped
Dump:	~GLH0066.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows icon resource - 6 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\Leader Install.reg (copy)
Category:	dropped
Dump:	~GLH0068.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Windows Registry little-endian text (Win2K or above)
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\Splash.dll (copy)
Category:	dropped
Dump:	~GLH0038.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\UNWISE.EXE (copy)
Category:	dropped
Dump:	~GLH00be.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\Vspeller.hlp (copy)
Category:	dropped
Dump:	~GLH0041.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows 3.0 help, Mon Jun 26 07:46:43 1995, 15819 bytes
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\temp.000
Category:	dropped
Dump:	temp.0000.0.dr
ID:	dr_65
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.7052309704892
Encrypted:	false
Size:	65536
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0018.TMP
Category:	dropped
Dump:	~GLH0018.TMP.0.dr
ID:	dr_64
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.028861333367489
Encrypted:	false
Size:	737280
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH001a.TMP
Category:	dropped
Dump:	~GLH001a.TMP.0.dr
ID:	dr_66
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	3.583166380719099
Encrypted:	false
Size:	32768
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH001c.TMP
Category:	dropped
Dump:	~GLH001c.TMP.0.dr
ID:	dr_67
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.96524150286448
Encrypted:	false
Size:	36352
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0020.TMP
Category:	dropped
Dump:	~GLH0020.TMP.0.dr
ID:	dr_68
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.089120021819503
Encrypted:	false
Size:	131072
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0022.TMP
Category:	dropped
Dump:	~GLH0022.TMP.0.dr
ID:	dr_69
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.410245982768783
Encrypted:	false
Size:	166408
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0024.TMP
Category:	dropped
Dump:	~GLH0024.TMP.0.dr
ID:	dr_70
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.252985958221316
Encrypted:	false
Size:	270336
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0026.TMP
Category:	dropped
Dump:	~GLH0026.TMP.0.dr
ID:	dr_71
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.156440133381996
Encrypted:	false
Size:	49152
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0028.TMP
Category:	dropped
Dump:	~GLH0028.TMP.0.dr
ID:	dr_72
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.333176341341012
Encrypted:	false
Size:	331776
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH002a.TMP
Category:	dropped
Dump:	~GLH002a.TMP.0.dr
ID:	dr_73
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.746457717030502
Encrypted:	false
Size:	978944
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH002c.TMP
Category:	dropped
Dump:	~GLH002c.TMP.0.dr
ID:	dr_74
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	2.3504566016772293
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH002e.TMP
Category:	dropped
Dump:	~GLH002e.TMP.0.dr
ID:	dr_75
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.246881573679983
Encrypted:	false
Size:	98304
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0030.TMP
Category:	dropped
Dump:	~GLH0030.TMP.0.dr
ID:	dr_83
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.679003869553484
Encrypted:	false
Size:	69632
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0032.TMP
Category:	dropped
Dump:	~GLH0032.TMP.0.dr
ID:	dr_85
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	3.049776166526433
Encrypted:	false
Size:	28672
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0034.TMP
Category:	dropped
Dump:	~GLH0034.TMP.0.dr
ID:	dr_87
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	7.37345791496555
Encrypted:	false
Size:	614400
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0036.TMP
Category:	dropped
Dump:	~GLH0036.TMP.0.dr
ID:	dr_89
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.049971707081366
Encrypted:	false
Size:	151552
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0038.TMP
Category:	dropped
Dump:	~GLH0038.TMP.0.dr
ID:	dr_90
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	7.256597293119583
Encrypted:	false
Size:	348160
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0039.TMP
Category:	dropped
Dump:	~GLH0039.TMP.0.dr
ID:	dr_91
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.6911576292255965
Encrypted:	false
Size:	895488
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH003b.TMP
Category:	dropped
Dump:	~GLH003b.TMP.0.dr
ID:	dr_92
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.3851069630408555
Encrypted:	false
Size:	467952
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH003d.TMP
Category:	dropped
Dump:	~GLH003d.TMP.0.dr
ID:	dr_93
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.343192645174317
Encrypted:	false
Size:	460744
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH003f.TMP
Category:	dropped
Dump:	~GLH003f.TMP.0.dr
ID:	dr_10
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.85586167527215
Encrypted:	false
Size:	97280
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0041.TMP
Category:	dropped
Dump:	~GLH0041.TMP.0.dr
ID:	dr_11
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows 3.0 help, Mon Jun 26 07:46:43 1995, 15819 bytes
Entropy:	5.621230348072978
Encrypted:	false
Size:	15819
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0042.TMP
Category:	dropped
Dump:	~GLH0042.TMP.0.dr
ID:	dr_19
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.267916653727831
Encrypted:	false
Size:	373528
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0044.TMP
Category:	dropped
Dump:	~GLH0044.TMP.0.dr
ID:	dr_20
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.389712107492356
Encrypted:	false
Size:	399064
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0046.TMP
Category:	dropped
Dump:	~GLH0046.TMP.0.dr
ID:	dr_22
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.111524345263303
Encrypted:	false
Size:	278528
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0048.TMP
Category:	dropped
Dump:	~GLH0048.TMP.0.dr
ID:	dr_24
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.068761083153915
Encrypted:	false
Size:	70656
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH004a.TMP
Category:	dropped
Dump:	~GLH004a.TMP.0.dr
ID:	dr_25
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.075838995531169
Encrypted:	false
Size:	176128
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH004c.TMP
Category:	dropped
Dump:	~GLH004c.TMP.0.dr
ID:	dr_26
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.357887444123624
Encrypted:	false
Size:	458752
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH004e.TMP
Category:	dropped
Dump:	~GLH004e.TMP.0.dr
ID:	dr_27
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.089217806514324
Encrypted:	false
Size:	90112
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0050.TMP
Category:	dropped
Dump:	~GLH0050.TMP.0.dr
ID:	dr_28
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.362853150418287
Encrypted:	false
Size:	53248
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0052.TMP
Category:	dropped
Dump:	~GLH0052.TMP.0.dr
ID:	dr_29
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.231857747585676
Encrypted:	false
Size:	446464
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0054.TMP
Category:	dropped
Dump:	~GLH0054.TMP.0.dr
ID:	dr_30
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.356793972262337
Encrypted:	false
Size:	49152
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0056.TMP
Category:	dropped
Dump:	~GLH0056.TMP.0.dr
ID:	dr_76
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	3.6387207259885197
Encrypted:	false
Size:	28672
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0058.TMP
Category:	dropped
Dump:	~GLH0058.TMP.0.dr
ID:	dr_77
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.055351231701599
Encrypted:	false
Size:	122880
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH005a.TMP
Category:	dropped
Dump:	~GLH005a.TMP.0.dr
ID:	dr_78
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.3109544955693755
Encrypted:	false
Size:	897024
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH005c.TMP
Category:	dropped
Dump:	~GLH005c.TMP.0.dr
ID:	dr_79
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.429321710388668
Encrypted:	false
Size:	493328
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH005e.TMP
Category:	dropped
Dump:	~GLH005e.TMP.0.dr
ID:	dr_80
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy:	7.40408306420629
Encrypted:	false
Size:	713728
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0060.TMP
Category:	dropped
Dump:	~GLH0060.TMP.0.dr
ID:	dr_81
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.1419354872122245
Encrypted:	false
Size:	569344
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0062.TMP
Category:	dropped
Dump:	~GLH0062.TMP.0.dr
ID:	dr_82
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	3.2759594709462525
Encrypted:	false
Size:	28672
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0064.TMP
Category:	dropped
Dump:	~GLH0064.TMP.0.dr
ID:	dr_84
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	RIFF (little-endian) data, AVI, 260 x 40, 10.00 fps, video: RLE 8bpp
Entropy:	4.092094049036708
Encrypted:	false
Size:	9484
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0065.TMP
Category:	dropped
Dump:	~GLH0065.TMP.0.dr
ID:	dr_86
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows icon resource - 4 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Entropy:	3.8173269579736644
Encrypted:	false
Size:	9158
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0066.TMP
Category:	dropped
Dump:	~GLH0066.TMP.0.dr
ID:	dr_88
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows icon resource - 6 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Entropy:	4.463750079084321
Encrypted:	false
Size:	22486
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0067.TMP
Category:	dropped
Dump:	~GLH0067.TMP.0.dr
ID:	dr_12
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows icon resource - 4 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Entropy:	4.020091845420685
Encrypted:	false
Size:	9158
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0068.TMP
Category:	dropped
Dump:	~GLH0068.TMP.0.dr
ID:	dr_13
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Windows Registry little-endian text (Win2K or above)
Entropy:	3.705302473519483
Encrypted:	false
Size:	3176
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0069.TMP
Category:	dropped
Dump:	~GLH0069.TMP.0.dr
ID:	dr_14
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.002178020558575
Encrypted:	false
Size:	53248
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH006b.TMP
Category:	dropped
Dump:	~GLH006b.TMP.0.dr
ID:	dr_15
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 22050 Hz
Entropy:	7.404294054350747
Encrypted:	false
Size:	529436
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH006c.TMP
Category:	dropped
Dump:	~GLH006c.TMP.0.dr
ID:	dr_16
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.229220592179937
Encrypted:	false
Size:	299008
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH006e.TMP
Category:	dropped
Dump:	~GLH006e.TMP.0.dr
ID:	dr_17
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.944769346213562
Encrypted:	false
Size:	1712128
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH0070.TMP
Category:	dropped
Dump:	~GLH0070.TMP.0.dr
ID:	dr_18
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	4.510690879715675
Encrypted:	false
Size:	49152
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\Bin\~GLH00be.TMP
Category:	dropped
Dump:	~GLH00be.TMP.0.dr
ID:	dr_118
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.653617845218506
Encrypted:	false
Size:	149504
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Program Files (x86)\LEADER\CustomHelp.htm (copy)
Category:	dropped
Dump:	~GLH0076.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\bin\TimesUp.wav (copy)
Category:	dropped
Dump:	~GLH006b.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 22050 Hz
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\~GLH0016.TMP
Category:	dropped
Dump:	~GLH0016.TMP.0.dr
ID:	dr_63
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.257746764198427
Encrypted:	false
Size:	3981312
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

Details

File:	C:\Program Files (x86)\LEADER\~GLH0075.TMP
Category:	dropped
Dump:	~GLH0075.TMP.0.dr
ID:	dr_23
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	data
Entropy:	6.6692259983102735
Encrypted:	false
Size:	264288
Whitelisted:	false

Details

File:	C:\Program Files (x86)\LEADER\~GLH0076.TMP
Category:	dropped
Dump:	~GLH0076.TMP.0.dr
ID:	dr_31
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.889585424939446
Encrypted:	false
Size:	355
Whitelisted:	false

Details

File:	C:\ProgramData\LEADER\Help.chm (copy)
Category:	dropped
Dump:	~GLH00bc.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows HtmlHelp Data
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\ProgramData\LEADER\~GLH00bc.TMP
Category:	dropped
Dump:	~GLH00bc.TMP.0.dr
ID:	dr_113
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows HtmlHelp Data
Entropy:	7.996231251702734
Encrypted:	true
Size:	2108096
Whitelisted:	false

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LEADER\LEADER Help.lnk
Category:	dropped
Dump:	LEADER Help.lnk.0.dr
ID:	dr_115
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Apr 26 14:46:50 2024, mtime=Fri Apr 26 14:46:50 2024, atime=Fri Sep 15 04:39:06 2023, length=2108096, window=hide
Entropy:	4.687336666081155
Encrypted:	false
Size:	703
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LEADER\LEADER Program Folder.lnk
Category:	dropped
Dump:	LEADER Program Folder.lnk.0.dr
ID:	dr_114
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Directory, ctime=Fri Apr 26 14:46:45 2024, mtime=Fri Apr 26 14:46:50 2024, atime=Fri Apr 26 14:46:48 2024, length=0, window=hide
Entropy:	4.650277257188404
Encrypted:	false
Size:	1019
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LEADER\LEADER User Folder.lnk
Category:	dropped
Dump:	LEADER User Folder.lnk.0.dr
ID:	dr_116
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Fri Apr 26 14:46:48 2024, mtime=Fri Apr 26 14:46:50 2024, atime=Fri Apr 26 14:46:50 2024, length=8192, window=hide
Entropy:	4.618875375880005
Encrypted:	false
Size:	1114
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LEADER\LEADER.lnk
Category:	dropped
Dump:	LEADER.lnk0.0.dr
ID:	dr_112
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Fri Apr 26 14:46:45 2024, mtime=Fri Apr 26 14:46:50 2024, atime=Fri Mar 1 14:42:26 2024, length=3981312, window=hide
Entropy:	4.643469599026513
Encrypted:	false
Size:	1148
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\Public\Desktop\LEADER.lnk
Category:	dropped
Dump:	LEADER.lnk.0.dr
ID:	dr_111
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Fri Apr 26 14:46:45 2024, mtime=Fri Apr 26 14:46:45 2024, atime=Fri Mar 1 14:42:26 2024, length=3981312, window=hide
Entropy:	4.663146888375859
Encrypted:	false
Size:	1130
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Buncefield BowTie Example.ldr (copy)
Category:	dropped
Dump:	~GLH00ad.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Chlorine Unloading and Blowdown.ldr (copy)
Category:	dropped
Dump:	~GLH00ae.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Chlorine Unloading and Blowdown.ldr.Change1 (copy)
Category:	dropped
Dump:	~GLH00b6.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Chlorine Unloading and Blowdown.ldr.Change2 (copy)
Category:	dropped
Dump:	~GLH00b7.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Chlorine Unloading and Blowdown.ldr.Change3 (copy)
Category:	dropped
Dump:	~GLH00b8.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Chlorine Unloading and Blowdown.ldr.Change4 (copy)
Category:	dropped
Dump:	~GLH00b9.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\D-20-03-F-100-15.PDF (copy)
Category:	dropped
Dump:	~GLH00ba.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PDF document, version 1.3, 1 pages
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Dictionary\Custom.dic (copy)
Category:	dropped
Dump:	~GLH0074.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Dictionary\~GLH0074.TMP
Category:	dropped
Dump:	~GLH0074.TMP.0.dr
ID:	dr_21
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.344952910595728
Encrypted:	false
Size:	2238
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Example 3-dimensional risk scoring.ldr (copy)
Category:	dropped
Dump:	~GLH00af.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Example FMEA.ldr (copy)
Category:	dropped
Dump:	~GLH00b0.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Example Hazard Review.ldr (copy)
Category:	dropped
Dump:	~GLH00b1.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Example Procedure Writing Worksheet.ldr (copy)
Category:	dropped
Dump:	~GLH00b2.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\HAZID-Bowtie Example.ldr (copy)
Category:	dropped
Dump:	~GLH00b3.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Isostripper.ldr (copy)
Category:	dropped
Dump:	~GLH00b4.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\ProgramUseLog.txt
Category:	dropped
Dump:	ProgramUseLog.txt.68.dr
ID:	dr_120
Target ID:	68
Process:	C:\Program Files (x86)\LEADER\LEADER.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.548534836718838
Encrypted:	false
Size:	128
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Causes only.txt (copy)
Category:	dropped
Dump:	~GLH0080.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (20006), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Checklist Topics,Detailed Questions,Responses,ActionNum,RepeatingHdr.txt (copy)
Category:	dropped
Dump:	~GLH0081.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (22296), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Checklist Topics,Responses,ActionNum,RepeatingHdr.txt (copy)
Category:	dropped
Dump:	~GLH0082.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (22680), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,MatrixSLR,Sfg,ActionTypeNoText,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH0084.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23217), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,MatrixUnmitSLR,Sfg,MitSLR,ActionTypeNo,ProjSLR,S-Hdr,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH0085.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23719), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,SLR,Sfg,RecNoText,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH0089.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23137), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,Sfg,ActionTypeNo,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH0086.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23653), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,Sfg,MatrixSLR,ActionTypeNoTextResp,S-Hdr,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH0087.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (22908), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,Sfg,RecNoText,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH0088.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (24033), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\Dev,Cause,Conseq,UnmitSLR,Sfg,ActionTypeNoText,R-Hdr.txt (copy)
Category:	dropped
Dump:	~GLH008a.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23217), with CRLF line terminators
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0080.TMP
Category:	dropped
Dump:	~GLH0080.TMP.0.dr
ID:	dr_41
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (20006), with CRLF line terminators
Entropy:	4.822942637652728
Encrypted:	false
Size:	20008
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0081.TMP
Category:	dropped
Dump:	~GLH0081.TMP.0.dr
ID:	dr_42
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (22296), with CRLF line terminators
Entropy:	4.8182315946153285
Encrypted:	false
Size:	22298
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0082.TMP
Category:	dropped
Dump:	~GLH0082.TMP.0.dr
ID:	dr_43
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (22680), with CRLF line terminators
Entropy:	4.813081562321656
Encrypted:	false
Size:	22682
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0084.TMP
Category:	dropped
Dump:	~GLH0084.TMP.0.dr
ID:	dr_44
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23217), with CRLF line terminators
Entropy:	4.816545844974567
Encrypted:	false
Size:	23219
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0085.TMP
Category:	dropped
Dump:	~GLH0085.TMP.0.dr
ID:	dr_45
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23719), with CRLF line terminators
Entropy:	4.8196958195404145
Encrypted:	false
Size:	23721
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0086.TMP
Category:	dropped
Dump:	~GLH0086.TMP.0.dr
ID:	dr_46
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23653), with CRLF line terminators
Entropy:	4.8166125902858665
Encrypted:	false
Size:	23655
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0087.TMP
Category:	dropped
Dump:	~GLH0087.TMP.0.dr
ID:	dr_47
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (22908), with CRLF line terminators
Entropy:	4.823443427551304
Encrypted:	false
Size:	22910
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0088.TMP
Category:	dropped
Dump:	~GLH0088.TMP.0.dr
ID:	dr_48
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (24033), with CRLF line terminators
Entropy:	4.8111372426784165
Encrypted:	false
Size:	24035
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH0089.TMP
Category:	dropped
Dump:	~GLH0089.TMP.0.dr
ID:	dr_49
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23137), with CRLF line terminators
Entropy:	4.813038462723673
Encrypted:	false
Size:	23139
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\PublishSettings\~GLH008a.TMP
Category:	dropped
Dump:	~GLH008a.TMP.0.dr
ID:	dr_50
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	HTML document, ASCII text, with very long lines (23217), with CRLF line terminators
Entropy:	4.816667855043304
Encrypted:	false
Size:	23219
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Custom LOPA Report Template.dotx (copy)
Category:	dropped
Dump:	~GLH0077.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Custom Report Template.dotx (copy)
Category:	dropped
Dump:	~GLH0078.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\CustomReportFields.docx (copy)
Category:	dropped
Dump:	~GLH007c.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Full Report Template.dotx (copy)
Category:	dropped
Dump:	~GLH0079.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\LEADER Blank Template.dotx (copy)
Category:	dropped
Dump:	~GLH007a.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\LEADER Macros.dot (copy)
Category:	dropped
Dump:	~GLH007b.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: LEADER Report Template, Subject: Standard Microsoft Word document template for reports generated by HazardReview LEADER. This file must be present in the root Leader4 directory. Contains the special paragraph/character styles, macros, and toolbars used in HazardReview LEADER reports., Author: Tom R. Williams, Template: Leader w-Comments macro2.dot, Last Saved By: Tom R. Williams, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Last Printed: Mon Nov 3 22:45:00 2003, Create Time/Date: Fri Dec 21 22:47:00 2018, Last Saved Time/Date: Fri Dec 21 22:47:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\LOPA Template.xltm (copy)
Category:	dropped
Dump:	~GLH007f.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Excel 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Outline.potx (copy)
Category:	dropped
Dump:	~GLH007d.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft PowerPoint 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Recommendations.potx (copy)
Category:	dropped
Dump:	~GLH007e.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft PowerPoint 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Spanish Template.ldt (copy)
Category:	dropped
Dump:	~GLH00ab.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\Task Analysis Template.ldt (copy)
Category:	dropped
Dump:	~GLH00ac.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH0077.TMP
Category:	dropped
Dump:	~GLH0077.TMP.0.dr
ID:	dr_32
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	7.8285113967862605
Encrypted:	false
Size:	121162
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH0078.TMP
Category:	dropped
Dump:	~GLH0078.TMP.0.dr
ID:	dr_33
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	7.823800367861878
Encrypted:	false
Size:	120162
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH0079.TMP
Category:	dropped
Dump:	~GLH0079.TMP.0.dr
ID:	dr_34
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	7.823880660416815
Encrypted:	false
Size:	120254
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH007a.TMP
Category:	dropped
Dump:	~GLH007a.TMP.0.dr
ID:	dr_35
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	7.682077676291142
Encrypted:	false
Size:	38770
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH007b.TMP
Category:	dropped
Dump:	~GLH007b.TMP.0.dr
ID:	dr_36
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: LEADER Report Template, Subject: Standard Microsoft Word document template for reports generated by HazardReview LEADER. This file must be present in the root Leader4 directory. Contains the special paragraph/character styles, macros, and toolbars used in HazardReview LEADER reports., Author: Tom R. Williams, Template: Leader w-Comments macro2.dot, Last Saved By: Tom R. Williams, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Last Printed: Mon Nov 3 22:45:00 2003, Create Time/Date: Fri Dec 21 22:47:00 2018, Last Saved Time/Date: Fri Dec 21 22:47:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
Entropy:	5.428784819628228
Encrypted:	false
Size:	337408
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH007c.TMP
Category:	dropped
Dump:	~GLH007c.TMP.0.dr
ID:	dr_37
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Word 2007+
Entropy:	7.555673580555201
Encrypted:	false
Size:	20048
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH007d.TMP
Category:	dropped
Dump:	~GLH007d.TMP.0.dr
ID:	dr_38
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft PowerPoint 2007+
Entropy:	7.9054712347869325
Encrypted:	false
Size:	300649
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH007e.TMP
Category:	dropped
Dump:	~GLH007e.TMP.0.dr
ID:	dr_39
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft PowerPoint 2007+
Entropy:	7.906981559338942
Encrypted:	false
Size:	308260
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH007f.TMP
Category:	dropped
Dump:	~GLH007f.TMP.0.dr
ID:	dr_40
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Excel 2007+
Entropy:	7.851740144653362
Encrypted:	false
Size:	447828
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH00ab.TMP
Category:	dropped
Dump:	~GLH00ab.TMP.0.dr
ID:	dr_95
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.664171156651563
Encrypted:	false
Size:	1310720
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\Templates\~GLH00ac.TMP
Category:	dropped
Dump:	~GLH00ac.TMP.0.dr
ID:	dr_96
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	1.7307109447678375
Encrypted:	false
Size:	1060864
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\WorksheetReportWorkshop.ldr (copy)
Category:	dropped
Dump:	~GLH00b5.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00ad.TMP
Category:	dropped
Dump:	~GLH00ad.TMP.0.dr
ID:	dr_97
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.4269603288058303
Encrypted:	false
Size:	1503232
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00ae.TMP
Category:	dropped
Dump:	~GLH00ae.TMP.0.dr
ID:	dr_98
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.7184149266523816
Encrypted:	false
Size:	1937408
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00af.TMP
Category:	dropped
Dump:	~GLH00af.TMP.0.dr
ID:	dr_99
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.1843512540211893
Encrypted:	false
Size:	1155072
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b0.TMP
Category:	dropped
Dump:	~GLH00b0.TMP.0.dr
ID:	dr_100
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	1.8523916987333753
Encrypted:	false
Size:	1060864
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b1.TMP
Category:	dropped
Dump:	~GLH00b1.TMP.0.dr
ID:	dr_101
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	1.9943472430316505
Encrypted:	false
Size:	1155072
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b2.TMP
Category:	dropped
Dump:	~GLH00b2.TMP.0.dr
ID:	dr_102
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	1.6576816979571791
Encrypted:	false
Size:	1130496
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b3.TMP
Category:	dropped
Dump:	~GLH00b3.TMP.0.dr
ID:	dr_103
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.260250823471266
Encrypted:	false
Size:	1343488
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b4.TMP
Category:	dropped
Dump:	~GLH00b4.TMP.0.dr
ID:	dr_104
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.185777797859427
Encrypted:	false
Size:	1171456
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b5.TMP
Category:	dropped
Dump:	~GLH00b5.TMP.0.dr
ID:	dr_105
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.1491061135115928
Encrypted:	false
Size:	1126400
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b6.TMP
Category:	dropped
Dump:	~GLH00b6.TMP.0.dr
ID:	dr_106
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.793505378538937
Encrypted:	false
Size:	1953792
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b7.TMP
Category:	dropped
Dump:	~GLH00b7.TMP.0.dr
ID:	dr_107
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.8289060151867718
Encrypted:	false
Size:	1953792
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b8.TMP
Category:	dropped
Dump:	~GLH00b8.TMP.0.dr
ID:	dr_108
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.6770254467371317
Encrypted:	false
Size:	1949696
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00b9.TMP
Category:	dropped
Dump:	~GLH00b9.TMP.0.dr
ID:	dr_109
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	Microsoft Access Database
Entropy:	2.7175688657467765
Encrypted:	false
Size:	1941504
Whitelisted:	false

Details

File:	C:\Users\Public\Documents\LEADER\~GLH00ba.TMP
Category:	dropped
Dump:	~GLH00ba.TMP.0.dr
ID:	dr_110
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PDF document, version 1.3, 1 pages
Entropy:	7.6920770281584385
Encrypted:	false
Size:	541081
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\GLCB916.tmp
Category:	dropped
Dump:	GLCB916.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.624821699887081
Encrypted:	false
Size:	147456
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates temporary files	System Summary

Details

File:	C:\Users\user\AppData\Local\Temp\GLFC501.tmp (copy)
Category:	dropped
Dump:	~GLH0000.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\GLGC4E0.tmp
Category:	dropped
Dump:	GLGC4E0.tmp.0.dr
ID:	dr_119
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.53048854921238
Encrypted:	false
Size:	25853
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\GLJB936.tmp
Category:	dropped
Dump:	GLJB936.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	2.496115780383093
Encrypted:	false
Size:	2560
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Spawns processes	System Summary	Process Injection

Details

File:	C:\Users\user\AppData\Local\Temp\~GLH0000.TMP
Category:	dropped
Dump:	~GLH0000.TMP.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.417810523175898
Encrypted:	false
Size:	9728
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery

Details

File:	C:\Users\user\AppData\Local\VirtualStore\Windows\netdet.ini
Category:	modified
Dump:	netdet.ini.68.dr
ID:	dr_121
Target ID:	68
Process:	C:\Program Files (x86)\LEADER\LEADER.exe
Type:	ASCII text, with very long lines (484), with CRLF line terminators
Entropy:	1.8174015084108828
Encrypted:	false
Size:	520
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Writes ini files	System Summary	File and Directory Discovery

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:46:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.991769917030027
Encrypted:	false
Size:	2673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:46:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.006987332628997
Encrypted:	false
Size:	2675
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.013659541083163
Encrypted:	false
Size:	2689
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:46:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.002664782853236
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:46:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9932930343181505
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 14:46:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.0054904797431545
Encrypted:	false
Size:	2679
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Details

File:	C:\Windows\LEADER.MIF
Category:	modified
Dump:	LEADER.MIF0.0.dr
ID:	dr_94
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.365238203483434
Encrypted:	false
Size:	1727
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\SysWOW64\COMDLG32.OCX (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Comct332.ocx (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Dblist32.ocx (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Jbfllf.dll (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\MSCOMCTL.OCX (copy)
Category:	dropped
Dump:	~GLH00bd.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Mscomct2.ocx (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Msstdfmt.dll (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Odbctl32.dll (copy)
Category:	dropped
Dump:	~GLH0004.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Richtx32.ocx (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Tabctl32.ocx (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Threed32.ocx (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\Vb5db.dll (copy)
Category:	dropped
Dump:	~GLH0003.TMP.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\temp.000
Category:	dropped
Dump:	temp.000.0.dr
ID:	dr_55
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.279860472114475
Encrypted:	false
Size:	102912
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0003.TMP
Category:	dropped
Dump:	~GLH0003.TMP.0.dr
ID:	dr_52
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	5.77619876481194
Encrypted:	false
Size:	89360
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0004.TMP
Category:	dropped
Dump:	~GLH0004.TMP.0.dr
ID:	dr_53
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.318871962599123
Encrypted:	false
Size:	72704
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0005.TMP
Category:	dropped
Dump:	~GLH0005.TMP.0.dr
ID:	dr_54
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.137883567396153
Encrypted:	false
Size:	140288
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0006.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH0007.TMP
Category:	dropped
Dump:	~GLH0007.TMP.0.dr
ID:	dr_56
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.326671003404017
Encrypted:	false
Size:	200496
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0008.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH0009.TMP
Category:	dropped
Dump:	~GLH0009.TMP.0.dr
ID:	dr_57
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.9709829593117805
Encrypted:	false
Size:	414944
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH000a.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH000b.TMP
Category:	dropped
Dump:	~GLH000b.TMP.0.dr
ID:	dr_58
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.462326786301514
Encrypted:	false
Size:	645616
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH000c.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH000d.TMP
Category:	dropped
Dump:	~GLH000d.TMP.0.dr
ID:	dr_59
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.041117183386059
Encrypted:	false
Size:	200704
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH000e.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH000f.TMP
Category:	dropped
Dump:	~GLH000f.TMP.0.dr
ID:	dr_60
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.127382876521697
Encrypted:	false
Size:	224016
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0010.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH0011.TMP
Category:	dropped
Dump:	~GLH0011.TMP.0.dr
ID:	dr_61
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.198400413601315
Encrypted:	false
Size:	203976
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0012.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH0013.TMP
Category:	dropped
Dump:	~GLH0013.TMP.0.dr
ID:	dr_62
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	5.969153911941781
Encrypted:	false
Size:	118784
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Windows\SysWOW64\~GLH0014.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH001f.TMP (copy)
Category:	dropped
Dump:	temp.000.0.dr
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Windows\SysWOW64\~GLH00bd.TMP
Category:	dropped
Dump:	~GLH00bd.TMP.0.dr
ID:	dr_117
Target ID:	0
Process:	C:\Users\user\Desktop\LEADER_Setup_2024-03-01.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	6.374228268320011
Encrypted:	false
Size:	1064456
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	Chrome Cache Entry: 208
Category:	downloaded
Dump:	chromecache_208.3.dr
ID:	dr_122
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (784)
Entropy:	5.152399224741798
Encrypted:	false
Size:	789
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
LEADER_Setup_2024-03-01.exe

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportLEADER_Setup_2024-03-01.exe

Files

Domains

IPs

IOC Report
LEADER_Setup_2024-03-01.exe