19209701b812fb013acbd88e340b814deaf36d51df6a5cb108324d56e28c5e1c

Analysis

max time kernel
103s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
Size 2.1MB
Sample260419-sqffcaaz6w
SHA256 19209701b812fb013acbd88e340b814deaf36d51df6a5cb108324d56e28c5e1c
MD5 b171281bb7cd5403ce1873f82b61f67d
SHA1 1679f24927ed846be8e9506c5aaf0ef8f13688b1
SHA512 3c382648b63e8ad0c875336d1add16b977c5592cca6b157cf61d2f6eb01216e5b3f676fe6c1da8ac33b80a567af6f2fc7ae89ddaad637681996ada1e3896e616
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQeDkxqatgl8bg:BCL2c8MNFLA0vb7w56rSqatglj
TLSH
T18CA56C4273988EA6D16F0274896246529B77BC210F119BCF13947EBE3E327C06E36767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral1/memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4380-7-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00070000000244c4-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000001e74d-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000023457-156.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000400000002172b-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1892-1391-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4380-1405-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021547-1508.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000a0000000244df-1612.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4380	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1892	2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
4380	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_b171281bb7cd5403ce1873f82b61f67d_cobalt-strike_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1892

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.1MB
SHA256 19209701b812fb013acbd88e340b814deaf36d51df6a5cb108324d56e28c5e1c
MD5 b171281bb7cd5403ce1873f82b61f67d
SHA1 1679f24927ed846be8e9506c5aaf0ef8f13688b1
SHA512 3c382648b63e8ad0c875336d1add16b977c5592cca6b157cf61d2f6eb01216e5b3f676fe6c1da8ac33b80a567af6f2fc7ae89ddaad637681996ada1e3896e616
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQeDkxqatgl8bg:BCL2c8MNFLA0vb7w56rSqatglj
TLSH
T18CA56C4273988EA6D16F0274896246529B77BC210F119BCF13947EBE3E327C06E36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaws.exe
Size 2.6MB
SHA256 9f7d68255b028d1c72e5ecf6e640dbca123873be4ab9fcf2a28b9752947a9482
MD5 cfb0143ff55f8c920e47b8abc61b300d
SHA1 85883900ed7e6b86a805db70c347aa5de739fd16
SHA512 406badb03c2df0abd07e9c60a336e8206d4cd2277cafb65a6f50f5279c0b864e17871c4fe14584434f5772010ee255ce8bfd37f0e9d2d6ea1887c05f3cdaad6c
SSDEEP 49152:BCL2c8MNFLA0vb7w56rSqatgljTd9CHKyao:YqcxAO1rYgCqo
TLSH
T106C57C41B3984AE5E06F427489624652DA77BC150F219BCF13947E6E3E337C06E3AB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 2.2MB
SHA256 6e57f0306b9a1744c5f9fc4b39d0ebdbca7589ddc60e2ad56dd8435b75a9b414
MD5 b63681f82d14bff7a5bdcf006b51ac5e
SHA1 5d2b441fc930673ba64e09771eb038d4a6031afb
SHA512 5ae7edec6150f016c9d954f8fe9da48ed6ae3bf461bdf8c3c302e8174172f8c732586a4fca6efad7c9de6eeb82c61e805a8273fd1dc713636878750703a0c2ef
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQeDkxqatgl8b4TjE:BCL2c8MNFLA0vb7w56rSqatglBw
TLSH
T1F9B56B4273984EE6D16F027489624652AB77BC210F119BCF13947EAE3E327C06E36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.7MB
SHA256 49840218976978247664d1667b36a779415d97dd37c445dc5d23f152f3b406df
MD5 02197c15ed22ae886c60f4d2f5cd6a71
SHA1 2fcc95d946fc9630c04c78d8af428c71688b1dd1
SHA512 a1bccebcdbbeef471a30c0002101c98245b0537b9c6cda7b8c7d700b1f8ad45298d499602044d01102f02ee96f4b948fc5be63ab3864ca02c060aad43b00e09d
SSDEEP 49152:BCL2c8MNFLA0vb7w56rSqatglfPji0Aj:YqcxAO1rYOjo
TLSH
T179D56C52B2688BA1D06F8175C5A25696EA737C510F208BCF1384BB7D3E337D19A36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe$

Path C:\Program Files\Google\Chrome\Application\chrome.exe$
Size 2.3MB
SHA256 6bd5f963046444f9467316e58670d5971d1dca93d8220784e09d0959e45a3f29
MD5 1b92f293f83c436abdbc537c0ced0873
SHA1 470da950e7cdc5ddc274cc44306e6dacbec1f366
SHA512 6819b76d2d7e3357150a9606d1aa3e1fa28066ee0344ba35233ee7b08325bcca0333bb99c3a375f8dcd41b679d2ede67c79b6be0bb9c5bca6afa2744a1591bfe
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQeDkxqatgl8blD:BCL2c8MNFLA0vb7w56rSqatglo
TLSH
T1A1B53941F2984AA5D15F0274CB624652BA73BC210FD197CB12D4FABE2F323C06EE6657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
Size 2.2MB
SHA256 9cc10ccc549e65b9c8e49a7894da6d2b63737fdc2c7af2f6815a57e3ce0e645c
MD5 6392339d383a8b9b4272c50a3eb563ab
SHA1 88e227cecaa42608119bc2f42235de54f9ad6855
SHA512 84ccd5e1b15a708f77c00114a2aa84aa809265056c6fb21368257a37c36820a63c354a55e1da5f1dc3a2fb25e00bb7b5373a62b8a2548bfb3db989a2413aba2e
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQeDkxqatgl8b6F:BCL2c8MNFLA0vb7w56rSqatglh
TLSH
T1DBB56B42B2984FA2D55F02708D664652AA37BD610F119BDF13947FBE3E323C06E26727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1892-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1892-1391-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1892-40-0x0000000000900000-0x0000000000A20000-memory.dmp

Download

memory/1892-1527-0x0000000000900000-0x0000000000A20000-memory.dmp

Download

memory/4380-71-0x00000000007F0000-0x0000000000910000-memory.dmp

Download

memory/4380-1405-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4380-1528-0x00000000007F0000-0x0000000000910000-memory.dmp

Download

memory/4380-7-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads