be036a1ef8fd4d0b2e03c48b48731f8de3821b6df1ae6385d597a1a44ff3d7e0

Analysis

max time kernel
118s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Size 3.3MB
Sample260417-sethtsc12t
SHA256 be036a1ef8fd4d0b2e03c48b48731f8de3821b6df1ae6385d597a1a44ff3d7e0
MD5 4a786b24cf7fbc89653d74307a876aec
SHA1 067c8df376abcb4ae3378de2ad35884225f194df
SHA512 cf8595b30f38f3077b6787f22a7fc1f516565e42f3c458983a63d0a1af119171c53c15a1b2804a88fd1d19cf2d8343e5e09bf8b3bd76912655834fa4ce90c463
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Lu:b9M9ReUJF3noxD255zjoT5ta1S
TLSH
T1E3F56D01F65046F9D4268131CA91626DB6777C118762DE8B1398EEACBFF29D09D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5728	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe$	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4724	2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
5728	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4724

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.3MB
SHA256 be036a1ef8fd4d0b2e03c48b48731f8de3821b6df1ae6385d597a1a44ff3d7e0
MD5 4a786b24cf7fbc89653d74307a876aec
SHA1 067c8df376abcb4ae3378de2ad35884225f194df
SHA512 cf8595b30f38f3077b6787f22a7fc1f516565e42f3c458983a63d0a1af119171c53c15a1b2804a88fd1d19cf2d8343e5e09bf8b3bd76912655834fa4ce90c463
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Lu:b9M9ReUJF3noxD255zjoT5ta1S
TLSH
T1E3F56D01F65046F9D4268131CA91626DB6777C118762DE8B1398EEACBFF29D09D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe$

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
Size 3.7MB
SHA256 b4a6676be5a30d29e58e19274176c9c669e49cb96250ea733b6c03ef7fa8c490
MD5 fcc1cb35a2177627889a606fcf5cb2f3
SHA1 f3fc326401fd59218a0460f44e3a2e34e433f9f2
SHA512 c1c0a4b4b29dc99b7a30e33d1d5fb897a06a280a50fd7122a1f9df82313d609a8661596cd6075a4af085e903968839544fafb70900ea89d53e90350cd0729d33
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1LsTd9CHKyao:b9M9ReUJF3noxD255zjoT5ta1mCqo
TLSH
T101067E01F79042F9D4768131CA51626DB6777C118722DE8B1398AEACBFB2AD05D3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe
Size 3.8MB
SHA256 7dad0425de3490f86d4a79a6d4669e6b444b423c124cc94c6bd9ab69796abd4a
MD5 a2157a2b131cdc4be3453d19fb537cf9
SHA1 c43762e3dca4de85dd99630d64aa3c7e1d1ce4b8
SHA512 7ac1bde98dff3f7cb3f2550dc57246a3b002a980f15b0cf72bc11d86fd37e0a00f00edaaf5105b77f49961d6b1d2339542108b71fad1a1e8dbe99e7abc33d1ca
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1LqUidGl:b9M9ReUJF3noxD255zjoT5ta1KdGl
TLSH
T17F067E01F65046F9D4268131CA91626DF6777C118762DE8B1398EEACBFB29D05E3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.8MB
SHA256 77c4272616d1105d715a69398ee8752c9ccc00dc7288031b6eed1a183f892155
MD5 39caef92a87e7cab19671d93af4a6d86
SHA1 2b4208a693000ab743df84b2a0c131acd75fe629
SHA512 a1ba947e420302a4cf380c7bf4fecd6a12cf27a5073f5bb12596343dac5e862efd334efb830f0a47a82780ae4412abf0720916111965b59becbf624dfd38dc66
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1LePji0Aj:b9M9ReUJF3noxD255zjoT5ta14jo
TLSH
T197066D01F65043B5D4668135CA91626DF6723C518722DECB1398EEACBFB3AD19D3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 3.3MB
SHA256 36f80912fefbcc210de0b4a3f55b35d87cb8765698ad0a06e127a4171b651f91
MD5 12ee39ecd9c7b3418f08f135e66e1a70
SHA1 486b61462aab00dd6d6d6dddf3156e6c0350e05b
SHA512 f8d7386bee5156f0ec883511046ebe1c2d98b8553567189601ff441cfef3e2432ff0fea82699d71b7b7b1fba42c582ed8730ebb3ed416b57053e003bff7e35e5
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Li:b9M9ReUJF3noxD255zjoT5ta1u
TLSH
T17AF57D01F65046F9D4268131CA91626DB6777C118762DE8B1398EEACBFF29D09D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
Size 3.7MB
SHA256 999c858b704704cd5c527eb60cff38af1f5fd00fd17449d9bb338ddf3fa06e18
MD5 26d7d0c7c2dfdafec88b62de8dd81bc4
SHA1 981eec1846955d5147c8549c9771c7c480ffb6b3
SHA512 a24a5edc5883c7e63f0c7f8f6bf0b6e2b9d4db7141b5b6bd08682f7ef64557a9a697bf6ea6a5ac1b623c7368a059e8023637cb737de6ff3a93d6b16933b279fd
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1LETd9CHKyaL:b9M9ReUJF3noxD255zjoT5ta1uCqL
TLSH
T1E8067E01F79042F9D4768131CA51626DB6777C118722DE8B1398AEACBFB2AD05D3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
Size 3.3MB
SHA256 69af6136e0133e68aa76456eae5aeee321da38776a89843388e72d2e77f537c6
MD5 b04ea0e27ec84aaf0fc29f09b5b57ea7
SHA1 fda6a6e54a1b607e082205ddf3dc0a4a4a15f7f8
SHA512 ad590e6dbbe59feea7c2198c9394b90956da836386f2cdba630e4a061c959c8b355a72b8735281ab5d6c2570b6252323fec42e0c01e2e1a52c040c7aaabe4d93
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Lm:b9M9ReUJF3noxD255zjoT5ta1C
TLSH
T1C6F56C01F65042F9D8664131CA95626DB6767C118722DE8B1398FFACBFB29D09D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveStandaloneUpdater.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
Size 3.5MB
SHA256 61a091909571cfd029347833f29d0890f601bc0a86a361c63ae8f20d239de1d2
MD5 d9675f89badd0994858301df5fedc291
SHA1 35fd8084ed050ccffcbec0aabb8431ce9bd9a344
SHA512 41d5a941f7c12e2797d3bb83d8582c9f32d470f55f8ca8e3aac983a3859838c85b8fb775bc58dcb1e392252a57a9fa5e025a2295828be279da8b3acb129f0867
SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1L8i2WH3:b9M9ReUJF3noxD255zjoT5ta1AuX
TLSH
T18C067D11F65042B9D4264131CA95627DB6767C118722DECB1398EEACBFF2AD09D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4724-1-0x0000000000680000-0x0000000000683000-memory.dmp

Download

memory/4724-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4724-23-0x0000000000680000-0x0000000000683000-memory.dmp

Download

memory/5728-42-0x0000000000540000-0x0000000000543000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads