njrat | 96011d03460f2cc4e079d2a54e0e81b4347aeb7b9eacdcaabc42692b0b1baed2

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2025, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
Size 6.9MB
Sample250808-cm1dcasp17
SHA256 96011d03460f2cc4e079d2a54e0e81b4347aeb7b9eacdcaabc42692b0b1baed2
MD5 fee2e29cf4848d103cfd7d8a875a4d01
SHA1 4304a7129988fd3cffef6456b70f417e67c28ddd
SHA512 e7e8728aec97b5797a30b15ffa0d5f078ae3bdc6882cc5601e64c474eeed6a8781412481aa758f0a6b9fdf36509f9915b0b531a3a20cd604373ec08bcd960504
SSDEEP 196608:RaV2MaWA1HeT39IigFkTet4Q4G/NsICxqMDJG:YV2Ms1+TtIifS1NsIOqM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat badusb defense_evasion discovery persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

BadUSB

paid-location.gl.at.ply.gg:53621

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	RuntimeBroken.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	RuntimeBroken.exe

Executes dropped EXE 3 IoCs

pid	Process
1892	main.exe
5408	RuntimeBroken.exe
4996	RuntimeBroken.exe

Loads dropped DLL 4 IoCs

pid	Process
4044	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
4044	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
4044	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
4044	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	RuntimeBroken.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroken.exe"	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	RuntimeBroken.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	RuntimeBroken.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	RuntimeBroken.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroken.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroken.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe
Token: 33	5408	RuntimeBroken.exe
Token: SeIncBasePriorityPrivilege	5408	RuntimeBroken.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 4044	6024	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe	79
PID 6024 wrote to memory of 4044	6024	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe	79
PID 4044 wrote to memory of 3372	4044	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe	80
PID 4044 wrote to memory of 3372	4044	2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe	80
PID 3372 wrote to memory of 1892	3372	cmd.exe	82
PID 3372 wrote to memory of 1892	3372	cmd.exe	82
PID 3372 wrote to memory of 1892	3372	cmd.exe	82
PID 1892 wrote to memory of 5408	1892	main.exe	83
PID 1892 wrote to memory of 5408	1892	main.exe	83
PID 1892 wrote to memory of 5408	1892	main.exe	83
PID 1892 wrote to memory of 4768	1892	main.exe	84
PID 1892 wrote to memory of 4768	1892	main.exe	84
PID 1892 wrote to memory of 4768	1892	main.exe	84
PID 3028 wrote to memory of 4996	3028	cmd.exe	88
PID 3028 wrote to memory of 4996	3028	cmd.exe	88
PID 3028 wrote to memory of 4996	3028	cmd.exe	88
PID 5408 wrote to memory of 5380	5408	RuntimeBroken.exe	90
PID 5408 wrote to memory of 5380	5408	RuntimeBroken.exe	90
PID 5408 wrote to memory of 5380	5408	RuntimeBroken.exe	90
PID 5408 wrote to memory of 4500	5408	RuntimeBroken.exe	91
PID 5408 wrote to memory of 4500	5408	RuntimeBroken.exe	91
PID 5408 wrote to memory of 4500	5408	RuntimeBroken.exe	91

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4500	attrib.exe
4768	attrib.exe
5380	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Users\Admin\AppData\Local\Temp\2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-08-08_fee2e29cf4848d103cfd7d8a875a4d01_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\\main.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\main.exe
      C:\\main.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Users\Admin\AppData\Roaming\RuntimeBroken.exe
        
        "C:\Users\Admin\AppData\Roaming\RuntimeBroken.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5408
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5380
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4500
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\RuntimeBroken.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RuntimeBroken.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Roaming\RuntimeBroken.exe
  C:\Users\Admin\AppData\Roaming\RuntimeBroken.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\_bz2.pyd
Size 83KB
SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
MD5 dd26ed92888de9c57660a7ad631bb916
SHA1 77d479d44d9e04f0a1355569332233459b69a154
SHA512 d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897
SSDEEP 1536:+yhz79151BVo1vXfzIFnaR4bO1AsCn8Bsjk+tI1CVQ7Sy4x+R:Nhzx15evXkuxAB8BMk+tI1CVQF
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\_decimal.pyd
Size 251KB
SHA256 95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5
MD5 cea3b419c7ca87140a157629c6dbd299
SHA1 7dbff775235b1937b150ae70302b3208833dc9be
SHA512 6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b
SSDEEP 6144:3uQjqbJrTwvqM+eYx+lDJOAkl9qWM53pLW1AcfRRR6tlISgOg:3sTwvWeS+xJw4ln7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\_hashlib.pyd
Size 64KB
SHA256 f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
MD5 d19cb5ca144ae1fd29b6395b0225cf40
SHA1 5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA512 9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519
SSDEEP 1536:/9gLpgE4Z27ARZWZnEmoAlI1OIH7SyT0xq:26RZeEmoAlI1OIHth
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\_lzma.pyd
Size 156KB
SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
MD5 8cfbafe65d6e38dde8e2e8006b66bb3e
SHA1 cb63addd102e47c777d55753c00c29c547e2243c
SHA512 fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4
SSDEEP 3072:lsvkxujgo7e2uONOG+hi+C8znfF9mNooXnmbutI1Z1mb:lnu0o7JUrNYOo2Kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\_socket.pyd
Size 81KB
SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
MD5 e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA1 36f367f68fb9868412246725b604b27b5019d747
SHA512 d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e
SSDEEP 1536:COYhekrkJqlerLSyypHi9/s+S+pzjii/n1IsJqKNBI1Lw9PD7Sy9duxJ:jwkJqHyypHi9/sT+pzjiE1IwdNBI1LwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\base_library.zip
Size 1.3MB
SHA256 f9a6c4e122e98b03a75873951933a985b7f971b9cacf31873fb9e71a012280a1
MD5 d3dfe419827aa79beab68ec3cf3e2e5a
SHA1 ad7f725523530b6e11b20d9f6b531bad6d81c1fb
SHA512 d58ab231fb2672fc69c12abd0320966cefda015b6884e057692332edede068a9baa5e00f66b48edcbe754a233f9eb9d78dd235c8357131c94a7e4cf84a8f2f5a
SSDEEP 12288:VHlJGUqQbLGgBvc+fYNXPh26UZWAzyX7jWYQqvQ7xiC5dmCPFHzVd8i1RbtRwBg:VHlJGUd6+zy/WUot5dmCPxTNHtRwBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\main.zip
Size 27KB
SHA256 2e0b693f1f6c749d41ef8c610113a0b2fbefc9e4cd92f34471690103daad3e3a
MD5 178be634061f2c341ab6b5ff781cc7b1
SHA1 e764cc5e725273385c4a1444ff2f7ec8d4ee65d8
SHA512 78d88e41d3562ab2153f51b5b254f44b64d7e5472ad4e255c32ab7229a10d5eced0212489a86702304f5ea8f3b319c5612babdce903d1b38c31f7af42b980022
SSDEEP 384:gGFWJssFsFxKxenalA7uycSlPzD+MO/99EN79UjFbUthHIZlUeDjb7CkWrJozH/H:bkV2FxKAnVtVDPIUHHonlb/UxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\python312.dll
Size 6.6MB
SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
MD5 cae8fa4e7cb32da83acf655c2c39d9e1
SHA1 7a0055588a2d232be8c56791642cb0f5abbc71f8
SHA512 db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
SSDEEP 49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\select.pyd
Size 30KB
SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
MD5 79ce1ae3a23dff6ed5fc66e6416600cd
SHA1 6204374d99144b0a26fd1d61940ff4f0d17c2212
SHA512 a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa
SSDEEP 384:I8RVBC9t6Lhz64SHfZslDT90YBI1QGjHQIYiSy1pCQQRaAM+o/8E9VF0NytuSS:1GyqHfK1HBI1QGT5YiSyvXAMxkEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60242\unicodedata.pyd
Size 1.1MB
SHA256 c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
MD5 b848e259fabaf32b4b3c980a0a12488d
SHA1 da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA512 4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27
SSDEEP 12288:FrEHdcM6hb/CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAa1:FrEXaCjfk7bPNfv42BN6yzUAa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Size 1KB
SHA256 44ab01be5398f3c1942ed535b2fc6089724895908b033e897b8d4fe21a94174d
MD5 b12cd2c7cd59cb13418403af40cc4a2a
SHA1 9c2778ef76b02243e80848fb69d479d4dd4d3906
SHA512 55a1589d0c123ccccfe511308a3596363b4d05c18856d7126522c1d0c5131078669da4638237d5466733decde618655075ac50670ba836293d3464c173427616
MD5 SHA1 SHA512

Submit Download

Windows.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Size 1KB
SHA256 cff6262bc09a3b766c456c7d420f6c55edde4adedaa55f99327495dcc93c2b43
MD5 5545d269c0f5fd3355c2005bc00491d0
SHA1 d66bf76c362043933877106e6304167401908b44
SHA512 8ee1114b4b3b8e25af06121313a9ab50da86a3462f6a97a2746620cba40e34dce31dc474bf3eeae7b45d3efb28455c7278dbafb4ef86d1287bccb450cc0f2bb7
MD5 SHA1 SHA512

Submit Download

main.exe

Path C:\main.exe
Size 27KB
SHA256 f9307a6380f34c3e2598d40141c7376cad132480f1fc7b3df00dce2a2ed6eb6d
MD5 3ca54f833192a09cbdc5f9e009bc56de
SHA1 84bd71bdf6c3efc32cc55e954cc227a0642b1b2e
SHA512 fdf47923f21802a9fa13b8efcecd7dfcde4bebc000183efbc68c7dd9e799cd5ff704432a5d124cbb96f783e259c73927c7c6e659bd04ce78caa214e5789a20c1
SSDEEP 384:LL1sZ3ZfjHnGgk8QgLLwv6mxePqOCQM5AQk93vmhm7UMKmIEecKdbXTzm9bVhcaw:f1Q31jHGqgn5A/vMHTi9bDs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1892-32-0x0000000074711000-0x0000000074712000-memory.dmp

Download

memory/1892-33-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/1892-46-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/5408-45-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/5408-47-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/5408-58-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads