ardamax | d2ee792c56a64a68464d287acea5b60e9602baa3b2ab2dab584f31c19f86b73a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
Size

4.1MB
MD5

51c7e758bba99b92263b2237528ba1f5
SHA1

9fda869428a15283480f653eb654aaa573c265b6
SHA256

d2ee792c56a64a68464d287acea5b60e9602baa3b2ab2dab584f31c19f86b73a
SHA512

0a42a7d2ef7126696c34182375b604d06603027633b7febf3c79e9ce53a757b12925e014f590ee69b562c8e76c27d3d8433e9c00dc3a445842ef919f2a379acb
SSDEEP

98304:BSkFZ2qI0mbL/RwoA5bnNITAU18sv+lC3gOYLgqQd3uDa:BeZ0m//E57mvB3VD1Oa

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000195b3-41.dat	family_ardamax

Executes dropped EXE 4 IoCs

pid	Process
2192	brinkedo.exe
2296	NBTH.exe
2136	PowerHEXSetup.exe
2012	AutoUpdator.exe

Loads dropped DLL 27 IoCs

pid	Process
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2192	brinkedo.exe
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
2192	brinkedo.exe
2192	brinkedo.exe
2296	NBTH.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2296	NBTH.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2136	PowerHEXSetup.exe
2012	AutoUpdator.exe
2012	AutoUpdator.exe
2012	AutoUpdator.exe
2012	AutoUpdator.exe
2012	AutoUpdator.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NBTH Agent = "C:\\Windows\\SysWOW64\\28463\\NBTH.exe"	NBTH.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\28463	NBTH.exe
File created	C:\Windows\SysWOW64\28463\NBTH.001	brinkedo.exe
File created	C:\Windows\SysWOW64\28463\NBTH.006	brinkedo.exe
File created	C:\Windows\SysWOW64\28463\NBTH.007	brinkedo.exe
File created	C:\Windows\SysWOW64\28463\NBTH.exe	brinkedo.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	brinkedo.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PowerHEX\Structures\Bitmap File Header.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Plugins\PanelExample.dll	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\259520470.tmp	PowerHEXSetup.exe
File created	C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\PowerHEX\AutoUpdater.lnk	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\Bitmap Info Header.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\Boot Sector FAT12.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\259520424.tmp	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\tips.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\UDP.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Color Sets\accent non letters and numbers.COL	PowerHEXSetup.exe
File created	C:\Program Files (x86)\Common Files\Thraex Software\AutoUpdator\259520346.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\Common Files\Thraex Software\AutoUpdator\AutoUpdator.exe	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\259520346.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\259520361.tmp	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Color Sets\Default.COL	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Plugins\259520408.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\MAC.chr	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\PowerHEX.chm	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\PowerHEX.chm	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\259520330.tmp	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Character Sets\EBCDIC.chr	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Character Sets\ASCII.chr	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Color Sets\Default.COL	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\259520392.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Plugins\Example.dll	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Plugins\PanelExample.dll	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Character Sets\ANSI.chr	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\Cursor Dir Entry.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Character Sets\MAC.chr	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\PowerHEX.exe	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Color Sets\rainbow.COL	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\TCP.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\ASCII.chr	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\Boot Sector NTFS.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\EBCDIC.chr	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\Icon Dir Entry.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\PHShellEx.dll	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Plugins\WaveEdit.dll	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Color Sets\accent letters and numbers.COL	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Color Sets\accent non letters and numbers.COL	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\Boot Sector FAT32.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Color Sets\259520470.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\259520470.tmp	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\Boot Sector FAT12.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Plugins\WaveEdit.dll	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\ANSI.chr	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\ICMP.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Character Sets\259520408.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\TCP.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\PHShellEx.dll	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\UDP.txt	PowerHEXSetup.exe
File created	C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\PowerHEX\PowerHEX Help.lnk	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Color Sets\accent letters and numbers.COL	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\Bitmap File Header.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\Boot Sector FAT32.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Plugins\Example.dll	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\tips.txt	PowerHEXSetup.exe
File created	C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\PowerHEX\PowerHEX.lnk	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\259520377.tmp	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Structures\Boot Sector NTFS.txt	PowerHEXSetup.exe
File opened for modification	C:\Program Files (x86)\PowerHEX\Character Sets\DOS.chr	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Structures\Icon Dir Entry.txt	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\259520439.tmp	PowerHEXSetup.exe
File created	C:\Program Files (x86)\PowerHEX\Plugins\259520470.tmp	PowerHEXSetup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PowerHEX Uninstaller.exe	PowerHEXSetup.exe
File opened for modification	C:\Windows\PowerHEX Uninstaller.exe	PowerHEXSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoUpdator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	brinkedo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NBTH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerHEXSetup.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6B9950-05A4-498F-AB7B-37B88922E82B}	PowerHEXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6B9950-05A4-498F-AB7B-37B88922E82B}\ = "PHShellEx ContextMenu Shell Extension"	PowerHEXSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6B9950-05A4-498F-AB7B-37B88922E82B}\InprocServer32	PowerHEXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6B9950-05A4-498F-AB7B-37B88922E82B}\InprocServer32\ = "C:\\Program Files (x86)\\PowerHEX\\PHShellEx.dll"	PowerHEXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6B9950-05A4-498F-AB7B-37B88922E82B}\InprocServer32\ThreadingModel = "Apartment"	PowerHEXSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PHShellEx	PowerHEXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PHShellEx\ = "{FD6B9950-05A4-498F-AB7B-37B88922E82B}"	PowerHEXSetup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2296	NBTH.exe
Token: SeIncBasePriorityPrivilege	2296	NBTH.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2296	NBTH.exe
2296	NBTH.exe
2296	NBTH.exe
2296	NBTH.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2192	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2192	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2192	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2192	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2132 wrote to memory of 2136	2132	51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2296	2192	brinkedo.exe	32
PID 2192 wrote to memory of 2296	2192	brinkedo.exe	32
PID 2192 wrote to memory of 2296	2192	brinkedo.exe	32
PID 2192 wrote to memory of 2296	2192	brinkedo.exe	32
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34
PID 2136 wrote to memory of 2012	2136	PowerHEXSetup.exe	34

C:\Users\Admin\AppData\Local\Temp\51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\51c7e758bba99b92263b2237528ba1f5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\brinkedo.exe
  "C:\Users\Admin\AppData\Local\Temp\brinkedo.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\28463\NBTH.exe
    "C:\Windows\system32\28463\NBTH.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2296
- C:\Users\Admin\AppData\Local\Temp\PowerHEXSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerHEXSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Common Files\Thraex Software\AutoUpdator\AutoUpdator.exe
    "C:\Program Files (x86)\Common Files\Thraex Software\AutoUpdator\AutoUpdator.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Thraex Software\AutoUpdator\AutoUpdator.exe

Filesize
304KB

MD5
57d3234578dd899f369244b429301dbc

SHA1
d87ee69fcb51dbfdbeb0ff61fdfd345a5662b1d1

SHA256
5ae2a931cd8ebba9addee7cfccf035c67c494b9f7096f8ff17c5a5adc261ccaa

SHA512
4781ed9d19106b7d549b80a50033450f2bf3a7a4915b0f6cd4b1fd1e2ca8c9b61aa11024c6e93a966454f86812305d3f70aeaf8392993d3999ec04b245bde6e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaiw259494950.bmp

Filesize
20KB

MD5
21b910dc6b277836e39eee02a689af3b

SHA1
e51051d1eb8ad27f7fda3e2e77dec7b59fc7d18a

SHA256
0609df041c81dd713fe28b703db06ce9e364b4390d592ed34c96a40b0f34274f

SHA512
e71b9c778629b310471a59253e1ed539ff9fa90328448bb472cf492a68780e3f4364da5e9915b4e4f9bd458989a5ca0f1fe3b1329800931082f2fdcaa2b6815f

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaiw259494951.bmp

Filesize
28KB

MD5
094ef20797ea7ace1b1eae08cb0f72d1

SHA1
3c95a0d40518f71c23b352be9780a892f845b380

SHA256
89040da21d749c9fdb038ab433417efd3daf9f5b27039eb2c7862324e999a6f8

SHA512
03657ab0ca5085a3009683937a3443f019ebf88fffd5e5316005bc3ae392cf02acfff57f3429b8ea78a1cd0d1287693515128bdc667a4c68b735a77459c10b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaiw259494952.bmp

Filesize
12KB

MD5
976873874d74764c20c974110e06a9bb

SHA1
31dc3d1af90fcef744689d4bf603642a5f73aee8

SHA256
001407dcaeb082f52ec7e927ce923e616cc97646e459592b80e924d41aa7e35d

SHA512
be4b03e16b717d365808481b60ef2ab0624b43db588f2b757afd6c0081e9f41f180f3ae3e974a452a09747202c981097437348447f8359389c54319606540c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaiw259494965.bmp

Filesize
766B

MD5
9334c1aacb3e11c056b106f9d337dbb6

SHA1
895f561752fdff27520164e0236d4b7b12d28d36

SHA256
4db3c4ac557b7bebdfe62dffb538b5b56c5bb0b53be75dfbc69764447e73f19d

SHA512
2d05811aa824353d54bc24392fe9561362c99be354262781a2da5a7b375f8f03c498ef7e5c38dc67713e469498a5b0e121f01e8af0fa48dc7ae299cba556de65

Download Submit
C:\Users\Admin\AppData\Local\Temp\aiw259494949.bmp

Filesize
20KB

MD5
e6da8d607f7592ef1c97d14d9f7fbd06

SHA1
9b2d6fa5de66cf0294ca2b2768a0f578dce618af

SHA256
36848e1c38a8a875577941b14eca7ba6f58749b794f1386ecbe56bc00a4a238f

SHA512
3c0935f183dbaeceb3274e4959f7efc92a56b1b66c2850ee03a5061252ad634cb1d89154c43c30361886b8d165138ef52c6a055294c27aae11646632cff1db7c

Download Submit
C:\Windows\PowerHEX Uninstaller.exe

Filesize
161KB

MD5
dd83f84c3702808690a73f56790ad21a

SHA1
12411ef07693046fc06dacabdf1afaa5b8e39a21

SHA256
53d06b6e0f307f208935cffc1a312d45da15ce5eb2b10c2d6a98bc430f7967b2

SHA512
270aafd7ac70cc91c8d3327e995b9b2e83f0c58aee771fc52847f870afe7e199c9d4191051cfb37ffe28786badd24f401007ef66ae4d3aae3344359feaf408a7

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
1533823edeb16a2f6130b0eac0a74b1a

SHA1
c00306974e0acda509d547d8947abbd19e848827

SHA256
e330dedede24e626c90b2894697df4d81228d583203b80775de310dd315f6a9a

SHA512
2d72b0b822de528943348881aa2f0855ef4d306df52f343ebbd8d8b8845da4a79a01efd88c1abf7645e4a72c4069d6d5d4c4d85f1dcd580ac61a9e2657303a87

Download Submit
C:\Windows\SysWOW64\28463\NBTH.001

Filesize
480B

MD5
5e289add554a68f261aa1ae80ce5a1ef

SHA1
e5a71600804cd8890da178ac13e3d683892e4ae5

SHA256
cb55c028060efe2414fdab82687ef2346be95f061c6f5cba3d9cfa53e16a93e8

SHA512
2f25bd26f90614836d50165663145f9b8a2ed33cb8bcabbfc8675462e90929e1710fce00c57245c34c4c7dbf69624a09ea27d084badfba6d09a7a63d96e958f8

Download Submit
C:\Windows\SysWOW64\28463\NBTH.007

Filesize
5KB

MD5
c14f089be45a2669a608c0cb4b5ed402

SHA1
6c3168f0af173afbc295848ad1bdb480c510097c

SHA256
dfd377848164271d02259d4481e7978a12392f71f7bcadaecae247d962127d08

SHA512
3c3bc020b74bd76eaa7b5fe577371fef420a62afa9512ef6a0d148b902fe98f8372358ab0f1213e389ad44d52a631ed117a6921be51d66734059cbfdef33ead9

Download Submit
C:\Windows\SysWOW64\28463\NBTH.exe

Filesize
472KB

MD5
a10c0ee1f0006cd3f58809ee8a6ab81f

SHA1
c4dcb5bffaaea97f7c6d850905a03c001a452d9a

SHA256
9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f

SHA512
ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157

Download Submit
\Program Files (x86)\PowerHEX\PHShellEx.dll

Filesize
28KB

MD5
b9db97f834b28cd919e7bbe41b344bbd

SHA1
d82669f30ae88cfb9bfb4bf364e82ceaab5deb5f

SHA256
16eaf4598fccb0d8e7763f2f0935843d327fa329fb65efe8bcd8efd769a03de2

SHA512
5f41b51985bc27f1b312cecdf70c038890124e9dc78762508b3318317df9a80d7bbbf5c4cbb142a80c9708bbfdfa4757b2f6e21de2416313d40da6c48f5d7a58

Download Submit
\Program Files (x86)\PowerHEX\PowerHEX.exe

Filesize
2.5MB

MD5
bfc23b18b39184214d818c534b8abf9e

SHA1
251b162c33a432850922cd86ee8625d3edaf4c14

SHA256
02f969eac3187e65373a37716ed567047ca7e22517590dde8a95a756973361cc

SHA512
7b06180478f90dc4eec841f5850edea67c1de0e80ca1df2b3eb11c2e2f927cbb700f4f36642170adf06b38e280be0d094a81a92017149912e5ecda659c37d550

Download Submit
\Users\Admin\AppData\Local\Temp\@9109.tmp

Filesize
4KB

MD5
67ce8b2ea53b0aa6ec6213a2b62b9d95

SHA1
e4ac32be20e72d1c12d0ba6919d5fd209a85d009

SHA256
2daed63cd25eb939ae46c5a1caf7fe07bde609a859720884b51d324ff45fc4f6

SHA512
760bef7efb0750d860909f2c92ef2190d7a63b8d07d83ba17997a2cd5c92f509f6c645d86bfbf22c3baff8ebabbf14856f8f4998b9d7132db19785190071c29e

Download Submit
\Users\Admin\AppData\Local\Temp\PowerHEXSetup.exe

Filesize
3.4MB

MD5
c0e27d7e2f5375ff8fad3e8aa90b43a3

SHA1
eec7c77ffaaf734bfdee194a1fe7313310f52a31

SHA256
e2c469f28adcb9330f865749b611466b4da6adcf9ce66b9845352e7293a2964b

SHA512
a7e6ca54c03b5d9a60f7a753dc4659fe0925c46209c763baf5e049018738c42fcf1362591fec1a0b65126d3cc99a7b3f23ea22b65282b687e4bcb602305f6f45

Download Submit
\Users\Admin\AppData\Local\Temp\brinkedo.exe

Filesize
479KB

MD5
d2bebe37ed4c05e55b68267f420911f3

SHA1
11f6170e67d941ca1516c2cb3556ba0ddb051939

SHA256
0e2888191cbe1856a236958a75fdee0f305f1483d7e8d48048c461205d0954af

SHA512
26834bf2d4eba394cdd58ddc941825855f0c91216294af3a18d72d655eebed7fca2f05d37b94a955015aa8d658854c313aa270aa5807c950e4c9489cb86eb173

Download Submit
\Windows\SysWOW64\28463\NBTH.006

Filesize
7KB

MD5
9bb764979044a263709a095f707fbf7f

SHA1
6a6ff5611d93c860401b165ff85957fbb340f14c

SHA256
6f55fcdfbdba9aef5252dfbb9a0f1ac9c83dac472659223ae5a7840484e2d95b

SHA512
a764c11ce03910f372ab7a19f251dbfcd369ad59a7e19b8f1a5825ef44f263d0c693f6bb69332bcb545ea397fc10497cbe4a83402a60971a07bdeb01ce19c057

Download Submit
memory/2132-45-0x0000000000400000-0x0000000000813F43-memory.dmp

Filesize
4.1MB

Download
memory/2132-1-0x0000000000400000-0x0000000000813F43-memory.dmp

Filesize
4.1MB

Download
memory/2136-187-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads