stihat | b6f612dea6805d7b532b5725487a6ed8d753f2736da9ff806b5df42017648eae

Analysis

max time kernel
135s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Size 3.6MB
Sample260425-cle11sb141
SHA256 b6f612dea6805d7b532b5725487a6ed8d753f2736da9ff806b5df42017648eae
MD5 1fee6275739d6f8ab5fbc96fe631e53c
SHA1 7c4c217db89aeda79dc901dd46188025fafd9568
SHA512 d2b76d5993a4f7f34ec9447192ce69a8a5dc73dfb074f89086825b5f2e7982965519713e1da2e6e77b11e8954dafe4d0fbd8e935715ee77aa6054988fc920fbe
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nr
TLSH
T10A066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 10 IoCs

resource	yara_rule
behavioral1/memory/4132-0-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/files/0x0008000000021698-5.dat	family_stihat
behavioral1/memory/4420-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/files/0x000100000000002c-17.dat	family_stihat
behavioral1/files/0x0007000000024449-35.dat	family_stihat
behavioral1/files/0x000100000000002a-43.dat	family_stihat
behavioral1/memory/4132-48-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/3892-49-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/4420-51-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat
behavioral1/memory/3892-68-0x0000000000400000-0x0000000000478000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral1/memory/4132-0-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0008000000021698-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4420-7-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000100000000002c-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000024449-35.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000100000000002a-43.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4132-48-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3892-49-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4420-51-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3892-68-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe

Executes dropped EXE 2 IoCs

pid	Process
4420	HelpMe.exe
3892	HelpMe.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\B:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\R:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\K:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\O:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Z:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\T:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\M:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\P:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\S:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\A:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\L:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Q:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\V:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\X:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\J:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\Y:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\G:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\N:	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	C:\AUTORUN.INF	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1896	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1896	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1896	explorer.exe
1896	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4420	4132	2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_1fee6275739d6f8ab5fbc96fe631e53c_amadey_darkgate_dridex_elex_gcleaner_necurs_smoke-loader_surtr.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4420

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3892

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
PID:5536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini.exe
Size 3.6MB
SHA256 5e9d42abdc921490aa72dc1cf9d5b10a73cd45241c0dbfb7d39b58458ac77d25
MD5 b1a2b50582e9501896224ec1cf887a0f
SHA1 b6ffb41eb9e55d6447fbbc232c68163209ffeca8
SHA512 aad99529928d98916c7af2b7ecbca340777d25c98550dca7f9e3250fcec11921fa5f7799da3aa4b57b8511011665b1207aab9a693e0622b0804c46445ce621b7
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6Y:+n8
TLSH
T1D8066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 836ebe7f3dc48e6d7f84f22b4a72303f01a0e0176a81a4efab55f5ae382ce6a2
MD5 624dbf17bc8fc721ca3f715861a39bbb
SHA1 8956333451fb6aa337eaa4361c028fd7e18db6a4
SHA512 916730097d4445daba12ff58fcc5ff32142ef4256cc9a6594d77bcae45417a08c33696ee5c5ab2fee5402bc40cd79a878c6b75f6a27d7576eaa02d5070ae131b
TLSH
T11431E0198BD77B61F276D179D6F24569E635BDE1B611FF4D009403480C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2dc6cd6d760d0475aae987804aedfb1ba7bde7c74e630140fd4bdcfb32913545
MD5 6d4983d7c0c88961708b5cf28c30d187
SHA1 04d628600a02fa30887298502691c62ad0c17eb9
SHA512 09fa89a7895d979214b62142a83d428bff3def25e3f85e0396f606f6e32772d634330096a74167a6b04553f14ce5fbeaf3994a47cbc552d8ab4557540189b813
TLSH
T1F111AB2915D13F67D3B1463A51E65331A6277D02F4A74FAE818846801C84221981AF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0461bff5d45c568f81cf3caadd09891db761b0f94185f66a7adbda7a1f22a75c
MD5 2d41f78cdf81e9679209414409dfd28b
SHA1 921ffecd2efb87f9388f686d0cd1cc6dc110b991
SHA512 157c9039a259300918a77891156dcf97db4244359876b9ccf1eddb6577a52e39d981e3618844943394526bc8376a6bd2177d2d72df409a246be62ba010ea705a
TLSH
T12111CE2916D13F67D3B1463B51E75331A6237D02F4A74FAE418C47801C88221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 afc8cd068c608ae32133ba24f165f60639a9d55bbb3965f894798ca93d49c594
MD5 4c526cca7fc7ef715091413befc2ea1d
SHA1 c8e492dc95ded4afd2b7810bbfc47422224ed8b6
SHA512 76c60e4d12c27803d57310d24a926dc995a8828f137f9007fa4319488af6297b88074b8112fc09b7feea631d956669028d1a9e20c11f0aa3e2e6a3a37abab6d7
TLSH
T19231E0198BD73B61F276E17AD6F24569E635BDE1B601FF4D005403480C31B40AA16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e45684da443c6bf9f6022d7d971e37a2c3243504829021d56f0ddd35099c36d4
MD5 d9577cc9867522e0e8bb49c506fb7add
SHA1 cccc368aacd4f7acd3c994808cfb6f1e750a161b
SHA512 176b10f5fc96e49154dc321a10eb537c6341a570f54a614bed644fe110fd90b6233bfb7b84e11f76e99d793b3e82f4ac8d54f77101d8d2d348abc0f13c6bb7b1
TLSH
T16711CE2915D13F67D3B1463A51E75331A673BD02F4A74FAE418D47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f3bc9fb3568bced0091e60658cf80e4bce8971c66818d04b8be78826520dc3c2
MD5 7e495545ca9ac03c9077456b4037259c
SHA1 8230a853f6b1c1cd89a30e4fc3c86ea485552ea6
SHA512 38f2c8056a4858493533943fca84cbb5602ca3ed4e6a1504ebb2ad7afe85decf743f1b4bb1b314f7d705574e8b36d16f0c8fc62a32c94a58e2ebe4f4cc6c1d63
TLSH
T14A11CE2956D13F67D3B1463A51E75331A6637D12F4A74FAE418C47801C88221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ed2736a03755fac90fef3f60c1d338cf0fe04235d92d315033ae6b6e7ea64059
MD5 747d2a804cfd1a7f9e2f17e735f77ed8
SHA1 7c45412f01765f01c6c2d81a42ce8f29cf9f5d89
SHA512 f6329a0d4c3555440238f8db2b947f5d31066e2fe3cd789ec0f5b8c86f58956fa590f0b44534bf396aefbbc62d6877f47cbdcaf86fc373a157f6fb7f4152f961
TLSH
T12131E0198BDB7B61F276D179D6F24569E635BDE1B641FF4D005403480C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2fa7606f693e1bef2629c7a7952484b6648f620d274daea75aa1a32aa6536f46
MD5 3fd55fc428ffe53e35a5a0aa20489fb8
SHA1 afcdcffcf1633be8952002006ad5c888613215dd
SHA512 d81e19dacafad2f3499ab361d5efbb7f7836416506d1fb25f5a29541e3397d0ed79ae1cd3054cb064a436cfad34b401a320ff8ff645e4e8bf91ce2d7d61233be
TLSH
T18011AB2915D13F67D3B1463A51E75331A6237D12F4A74FAE418846801C84221985AF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b7a4b1ed43a2c2f37e49fca5262ecf573935b20ed0e2f33e6a81b605ef74fa67
MD5 b07e1126aca2f12624ec5863ebf0b2f8
SHA1 e439105d38b11c69bb382047c4b654874b7f28c4
SHA512 7c008e3252268cdda7c6e11f8db3dadc1ee55b7baa1cbee2e9b59eb1273f5e7513ce48dbaddf07cf9280c78574fde1c976a5ca118eb388ed80ed8aefca000ab8
TLSH
T15931E0198BD77B61F276D17AD6F24569E635BDE1B601FF4D005403480C31740AA16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9aa3c6aceee182afc18c9ec5d4f964d8a250e6d1fc96cfdfb3aa8e04a2b24c98
MD5 5508b236bbc9391016ae57b398fac64d
SHA1 e1f246b94a492b588499575b353e7d028c6d12f9
SHA512 2f8a38afc0a051e19220dd90100292ef4335ffe0158c58f88675b697d50d2075ce75c5aab9ba440871d49fabf6061265b2e8730f583042aca508a9dd202a9c11
TLSH
T11211CE2956D13F67D3B1863A91E75331A623BD02F4A74FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 76adb69c362c3ef9e55e244c9774e23612899a10db75ff5f0f086456a267bf44
MD5 90513d91f0af217d63ce1ab678fc513e
SHA1 fd64f8df7120d2afd3266470ddfaef71bc755191
SHA512 0975442f99c60923b23bacffe9fac3dd01a65e7d445e5f97ddd341a9e7a60bcfa3f4a2c491413151e9ce72e95b1d51dcb74187c1fabedeadf2c11a91e76fde69
TLSH
T18D11CE2915D23F67D3B1463A51E75331A6637D02F4A78FAE418C47801C84221D85AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4a9caa2bb7f0cc29c7232c6dd3cdc7722b74126fd6ba35f7d609fe2b682da9e8
MD5 223546ea1ec084b94b3c33403afe7050
SHA1 abb247f616989ec307ad7b48b3c8d3a6dbc0fe64
SHA512 696d15fc84cdc79e098bbaa600e7e2a39baded35d3d21372b6b79fc7e7c4e2d82e71fb6098dbeb996c0c49139f0a57d2ca8b8a9c7052e1290cb86ede64d541fc
TLSH
T1C731E0198BDB3B61F276D179D6F24569E635BDE1B601FF4D0054034C0C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0ae262242cf10ea881358939605eaa2fbeec83112dd1ed342ce8296b938e45a0
MD5 371d1fb88cca2c6e61de1dec1ca577c3
SHA1 a52fdb26cef70423012664896f49d38447b06dba
SHA512 c7008c0382480b75fbc7ce96541448b6ca7f3395ee53bd9763803ac1a2f16e56e28cd0becaa2962c3e8437e032bf844c76e3b1086e403b646cbafcc36213b283
TLSH
T18911CE2915D13F67D3B1463A51E75331A623BD02F4A74FAE418C57805C84221D82AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b1feab60d940a3774ce01d321d562d1197215035a6d555c15a59f3368cca4693
MD5 9c2fb18fc80e724b332bcd8533409f4e
SHA1 73616b386d9ffa8f1bbbcd9fa721336db8a73ee7
SHA512 639a2297ffa75918cb8f473806983cbdbf601efb4963da6a5cbbd3110520c9bb204bce79f9862c6a0577a4019c3eea3899db13c68641678dfb0633976fecf876
TLSH
T17811CE2915D13F67D3B1463A51E75331A6237D02F4A74FAE818C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d13fd62d541ee7636684873a27ade348fc74a029095e32833c537b53cc2616f1
MD5 1e71fa9efa76dc5250fe397cc783ddf2
SHA1 183c6737a90343e746977c4d1d1b5a69cacaa316
SHA512 cb716b012c08c709a330f1fbde19ed494cf9a2753105db9fe83b3f4ce89ee5636344079fec19520b5e4bf6522aa15b9e16b8cbfca135fe8dc10425d00cdf7aa3
TLSH
T15831E0198BD73B61F276D179D6F24569E635BDE2B611FF4D005403480C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 24c9564487cd018d32864607f2293afc0005f2ddb066e936fa3526f2cdef3c70
MD5 aa72822f8df141030b71b11187548868
SHA1 5be899c9384cb30b9be6688f07829cd92f8592fd
SHA512 8dd8d268f7f1b0a30edae1bec0597b100289ceeb7d36030f3250ecc73def44e6aabe41e866d0c7740ee192e5a85f794d7b52130f49824678cfaa10d7849cd34e
TLSH
T19611CE2956D13F67D3B1863A51E75331A6637D02F4A74FAE418C47801C88221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 638c01f06cc709213d8a6aa22c33dcce78256f6ad8edf0af8500f748fe7336cf
MD5 4f9802bb4b93decbfe178a339dc7a31c
SHA1 d16727fe7836ad6541cc9171db720cbad317d09a
SHA512 4cb480729f82b95c718c0db1f3d1e5c17a344618f4122606559161574df238ac48e4645ee7d91005231b422f0b758624e1279e8c592c88bb169c0ea14908528a
TLSH
T17B11CE2915D13F67D3B1463A51F75731A6237D02F4A74FAE418C47801C84221D81AFBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 05d797b721809d2a4f07922394aa380d462da4bffe7a0f8a92be82be4c1ac818
MD5 5d28db6605f4df3b5bd265776b64f009
SHA1 23e99593691669b21ddaafbedb781bbd86ac679a
SHA512 2f4e4e17c4d8fb7e63976adba3beff2a3eb60a5c1d45c51495f091e5c763b1818cb1a993031035aa0d44d85adaa0e6518ec6cb97c927e8af5b9588270674bacb
TLSH
T17A31E0198BD73B62F276D179D6F24569E635BDE1B611FF4D005403480C317409E16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 003bf9e09942aea5efa7ed170a2d44b510352b419cce27887ad498b3274ac70a
MD5 db09ae1ccb3e510b2913e6942ff13a90
SHA1 9438e763a777e295314cada1a88d9b7986e8c832
SHA512 067a852b4bdcb02159f51166c54eea88cf3943c7179c9d5dc8cef6a4a1947fb0769ebdb1d0751f5ad8a1711ebc2239c882b95165eb013eafae57bdffd4dc82e1
TLSH
T13711CE2915D13F67D3B1463A51E75331A6237D02F4A74FAE418C47801C84221D82AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b21457ffee5bdac581462ae368f8ff0679c9e54360b2228843116351011fa840
MD5 1a5412a7bddcc1ed428470f92f30c0f2
SHA1 4450e793196d1cd03d31807f066d3914de832b54
SHA512 6d11406fa598d0855d47b67ac9692926e87ec71854b14183c9bbb3825da52641bb51514de7f21d1361194905a1c61cfc4814f4f7ed1df0659435ab5531c17ffb
TLSH
T13E11CE2916D13F67D3B1463A51E75331A6237D02F4A78FAE418C47801C84221D82AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3d96add78abdf8cf895ddc8041269e6f3f74ce528466da1dd06dd51c466ac864
MD5 7a76c986f2e27b0bd63bd306df71aed6
SHA1 90f2c1cd12c55acd2543cc364bb37718a4393310
SHA512 22c6ccef966ccc1f5517ad6a18a395371dcd1943542ce160ae266ad004f618dea5e015ec5c6c455606cfaf1a8dda4f8554fd0d63be844421ebe4457faa70c148
TLSH
T18431E0198BD73B62F276D179D6F24569E635BDE1B601FF4D005403480C71B409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3dddecc71e091a245abe9b954b7a26087afbf93efa9e1478a55bf0f5e7d46a0a
MD5 2255066d8bc290fe7ae1c8e776c12470
SHA1 2450ada94fa8d8cf9d2129d9a0fe37088ac04fbb
SHA512 6dfd53228c2dcda1b70217ea4811c0308d55d99b92859c9415d4e9f192d3253a432abca897f653f9a63dbc0dc269da64bd3ef30f90fa3d155a629295bad7c0b8
TLSH
T16511AB2915D13F67D3B1863A91E65331A623BD02F4A74FAE419846802C84221D81AF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 64a89457dfedd3ace059d222229e97a795961e9d67cc039d4438bb792221cfdd
MD5 a546a509243cdb1f7edb451b6f61f307
SHA1 5b02a1f14e5d7b0affef99525b4c3b89326d45e2
SHA512 d42caa3c347d76e8bfd75fb26e8bec75dd52f20b710959849a885209c41e2aa6e63b415e02b149a430f708def420f425b9284bfb3e028677c5f0881a9291ce53
TLSH
T12811CE2915D13F67E3F1463A51E75331A6237D02F4A74FAE419C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d3019555118500274f3341e081ba7d1b352b1aebe7499cc47cc0174292a7f121
MD5 7a9249e45c713082312bf30c7eeffd88
SHA1 f040cc77a51b5d7afe025e6aa52b394f73b322a9
SHA512 9ce58c66c398925cc422ae10c0268425fa7614cbd3eda87597dd7499ade3a4eddf2ce2096de3439952e45613ab8c608d5d21d35099ffc8c262128abb9ff6191f
TLSH
T1A131E0198BD73B61F276D179D6F24569E635BDE2B601FF4D005403480C31740AA16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 dadb8259ec304ec36ddb393f9ced08cd39b8de75f6f980eb8ed0f0ee4df8146c
MD5 363bd9ea148abd97039be6f5d03bfc32
SHA1 f220971e7904dfd9620700aeb724f51b0fdb1f81
SHA512 5200085da788ff7197b544cfa06aa90b422a81661ffb09367a8cacd6782e138a19d58a874e3bbf542549890b54bdcad860298797d2a6ee0feb2fde375ceef21a
TLSH
T1AA11CE2915D13F67D3B1463A51E75731A6237D02F4A74FAF418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 75fb2e6af918c7a155ffc8f0cf0fa97c018bc42ab92c32e183ea9f7f8fd0026e
MD5 4e878b89a53d0ee7c515e6fb9aad1ea1
SHA1 ee9fc44d19d3f150145c6f1b54ad920fc3a5c4ca
SHA512 a99213f5451c8c5e2c89b870a359dad4036ead639813fbaf3fa05c7c1baa3b6755360505c2a00a8bfe571bd525b37b18d812139039318d1d8bcb958c4b0f29ac
TLSH
T13A11CE2915D13F67D3F1463A51E75331A6237D02F4A74FAE418C47801C84221D82AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ea23be428a0614bc7ab0b97c088b61a86ee73e5896fc08e09a8254b3d23204a8
MD5 28adb03db24139f990308249fc1eda84
SHA1 fc122a6cb29478d2e7ca65b671c92517862d64e9
SHA512 06468df9b141197739390c59991612f845cf4f0bb468f30c1bb8d45d00129d9b479e9afed526d3ce1f4688d1cb867c96cb8e49da9115a9170730182f4e04e5fa
TLSH
T1B511AB2915D13F67D3B1463A51E65732A6237D02F4A74FAE419846801C84221985AFAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 18bb6bc1a0468d286128e97de0d36b2f8572ac9b1e6c65282ebaa570c58517f3
MD5 c5e248437a549bdfda82f690ac145e7a
SHA1 7b929ddadbbbc242b217b80eaa63624e5f88a579
SHA512 7b0011a0c9ff5d5ee0aa9eab6b59ea7773b80396f2df6cf71d24186a230a15c4747212a978ccbc9dc7ef9bc87f502e7da29da96bd8216ebd25dcdd50d28482a9
TLSH
T1AE31E0198BD73B61F276D179D6F24569E635BDE1B611FF4D005403480C71B409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fc6eab90774434bfe5f08dd8a07abff1aff6675bb7714650ce339dd3a9477605
MD5 205e9e561876498fd6b090684986df13
SHA1 de8b2a788ff66ca73ba15cf8fb575db773a66acf
SHA512 c9448acaf9ccefb5ca4a96f7486c89cdb9ad50d585399459ae9d990192caae300cd2c2c66c230e6f9b988ea7737c7772640a2b9e2d8e71e7bd340cc0873facf9
TLSH
T13211CE2915D13F67D3B1463A51E75731AA237D02F4A74FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3ce75b4d2f5f464f3c266deee39bbbd5a96e16bc51ba459ba273f58a1630ee05
MD5 dd4afdee5320eb9b82a6cd9c219dc229
SHA1 0757ad70e64e4417cc684c353f8d6068deebf300
SHA512 7b595c2a370b81f4883a1e48e29a5e3bcf55a24c19bed1ab3c9018a8043778ad3ac518616eb1e0f029d4a32cf5cfea644af517dd37b474817d16bbf5fd2bc1f4
TLSH
T1BB31E0198BD73B61F276D179D6F24569E635BDE1B611FF4D009403480C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 37fd6aadf6ce581941af1b9637005c56789aec36198e7982adf0614e40af66e7
MD5 66d884e02148deb224f62572c6edb612
SHA1 bbe69ee9aa94a2d0739edf818e951d122955991a
SHA512 7872c180f540eec7bdfb820f32ebb1b10fdaaef8d416ec4ff20537f0969097f33c2eb2b86670ab63c5da1b02fa0ca0fe36133b3b247c7960768b68298638c147
TLSH
T1E111CE2916D13F67D3B1463A51E75331A623BD12F4A78FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 dfd6823ed705128e315d80f35c6612207ac7e92195efccab2c35b800bad3954f
MD5 6287e44e9dded2c2038cb45f1c6ae446
SHA1 4b402219ea89b8b6f05cbaf456782cc64255366e
SHA512 5198c03ec46b5ea7b3c21910ec526fa0fc2e2355171841a8ee8d8e59a099a7c59b6113e85889ce309b51efb3766be4ce350aeb0ba26bdd42c4193f45a0945cf9
TLSH
T1F411CE2915D13F67D3B1863A51E75331A6337D02F4A74FAE418D47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9e30748df14aed3e2b5e6ec67ea8526e3923796cc10749249b58efeac4e7ed85
MD5 19def732cd4fd5727a75b774458782b0
SHA1 2cbb059f6dea62ababf985d1262c1414c2b000a0
SHA512 ca816ec2dddc3aee58df42e9afa75b944bd763b8948dc7d8e93bbc7b4b145af527498853248ab131c047e9ce33b885eb6071f38c4cb94cc99db286a633f2f539
TLSH
T1C731E0198BD77B61F276E179D6F24569E635BDE1B601FF4D0054034C0C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c9460319ba11c9fdd3830ab9a28e21aeeba06345643c5214f86e11141b386b77
MD5 9e01eb7a26b48089ae1d8122b0f2df97
SHA1 757a24446b1528b369d5b9bec9f8fe1d1b3113f3
SHA512 e01b1fe5b10e8f1241121eb7d7cfe8ef916216a4267997a6e20ef4ce35a90207834028e71c75c62e5a39afe7cebd4b9ace21286a0d2a09ff520b7245647b46b8
TLSH
T12311AB2915D13F67D3B1463A51E65331A6237D02F4A74FAE419946801C84221D85AF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3c47c2c53b134508d2275af2df01d16271661e9385c0304e6dea61aeed91c9b4
MD5 b23204c0c1bc93be284114a74c37430b
SHA1 ad565933853a7396f12a58d2a904e19743ed408d
SHA512 a9f4b47028c23073b16e614aed4381ac320b6dd50b7bba8b5dafb4060f6f9aded82b09470f8fae9b9beb94b435a32f05637ac9fc6d369f34674f1e1e7bc085d2
TLSH
T1E711CE2915D23F67D3B1463A51E75331A623BD02F4A74FAE418D47801C84221D85AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 99b2991aeceeb3d5449fb1af91fffc2e0e33854cf2cb8e65fcf1fcadcb129f84
MD5 1075e7fbdc1b1d719a91d4344e68a1de
SHA1 214b4433fa3e324cf3e70c2a8966357bd18c9a5c
SHA512 33827fdf14c7ec7eff3bfdf04a35e8c0d25990fed923c4172725b5844654295f2a6958fe6eaae6f490b669282ab7ececa506d4939caf47642d45dec9d835c58a
TLSH
T12331E0198BD73B61F276E179D6F24569E635BDE1B602FF4D005403480C31B409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 aaca1acf12792b80dbae9fc861777322841ef8c060cbfe7743c1cfab70ddd77c
MD5 eaa11bb23b3c911e16af0606277714e7
SHA1 144b3b99286efb8dd32856a44db5fff308634639
SHA512 b6a626be46585e8225885e7168a14fb479ddd6d3d8baf11ddeac1ea368bd44ab32274f68e01e7918c92747587de217904172eddcff4945642857433dbca0db80
TLSH
T10131E0198BDB3B61F276D179D6F24569E635BDE2B601FF4D005403480C31740AA16F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 81da52377e9c3094508a9cc6658e2a2010fc1ad599bc0f028875a84ef4635511
MD5 f6184f65fe97fe3f0e3b5a3599c67bec
SHA1 9984248e044b9d509565abd3651f9a1213cf7ee6
SHA512 af9ec842b114eaf94f65c91a15d97a7e4c5577bc663272b92cea7b4cfa1d2e00b6e9006db28ed6990fbca0a3daef59e40784dd43ec70c19de08a28144a162dec
TLSH
T12C11CE2915D23F67D3B1463A51F75332A6237D02F4A78FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e3553e6138d8daf2f373eae78ca092dce295b789b1db5423eae56fbc99628b72
MD5 344a39c6158ec934fb1ed41b43048c13
SHA1 de17161045678db67b0b50d37b8c9d853572b679
SHA512 b262d21dc998ea3d3841cfa0844c58424791e8f7e315fc681b07d3d3405d7e999e99c083e689d8e758d9e15a2dea05a9813db3be31f44016bfe9bed78358c9e6
TLSH
T10A31E0198BD73B61F276D17AD6F24569E635BDE1B601FF4D0054034C0C31740AA16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 80db00973901682c02c0d2905c169c851009de0e693cb927a1f0684da5db61b0
MD5 6182fcfb15cdbd396c91ff4a2bf67ad3
SHA1 f9d20f3d912b4568c3592fe855d3226bf805f04f
SHA512 c32340011fc00f998dc99516d3f25f02b6b83a1787fbd03cd55f467f140999e414ca47562437ae95d568f706197bdb8e238632d27d00e4c23f8dba667158b2ab
TLSH
T16011CE2955D13F67D3B1463A51F75331A6237D12F4A74FAE419C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 66e66eee12f660152745f9645b248ed85e30e7a993abacc6047c2ae6cb627169
MD5 42b61924d72bce5610d1e84269ede62d
SHA1 86174c5ed8bbad4beeb9d7921b873b2d1e13f492
SHA512 ec22ded6be51ef6f6f35ae971664acd977ba69efa5c903369e8ccf8f12639747b4bc0cb038a7464aae390abc3192d082e070e09581d0a77068fb04767e78156b
TLSH
T15711CE2915D13F67D3B1463A51F75331A6237D02F4A74FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3917357da191862067990cc4adef3ee86649d58d211c15206fbac8033f710928
MD5 08356f2b31b80907d5f0b742e441edf0
SHA1 73177f0cdb9320dc2d109bc31a56eb28cbcd08cb
SHA512 db10bf0be9aa4d2abded03c974ab39a70f86fe1f37a43864fadcb36af0b90ddcacf19820b4dc4c29a44d418a163353b99c48b566cf76ed82aade6229c7e27c0b
TLSH
T12511CE2915D13F67D3B1863B51E75331A6237D02F4A74FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0e47e9f52651532c86ab77c1c15e80b64e7ff883a91da46981469cbfab5ef43f
MD5 ee06c751c8e6052ca6a94f0bd45f6c29
SHA1 c7ffd7d09e6948d07aedb5d41a32ab2b6c50d40b
SHA512 15e87057d9cfd646b977fb01e875ac35ad0c18fd81283d39553c0431b6af0ae59f2214404901d97435b66cae0f247bcbc144a964323ebd99bee0cf69c4d3442f
TLSH
T12531E0198BD73B61F276D17AE6F24569E635BDE1B611FF4D005403480C317409E16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 121fe58f483d2805354c203bb7540a9e697ba91cef0f6548908f7e72f768abe8
MD5 980fb17a074c4e9845cd4ea72b279f2d
SHA1 801f6f5619693297f6bb65faebd98ed15fabac9d
SHA512 883e72a9b7016b5b862017c1df154ba2f69dd4a14d7291df3688d75ded72935124da97becb933679234434547596561ef80504ea3bb78b5c0e448993c4dac072
TLSH
T15D11CE2916D13F67D3B1863A51E75731A6637D02F4A74FAF419C47802C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 2b6413e421402587d82fd7ba57a93ffd636652a6d1aa775bb0d49dd18da0031e
MD5 4646d2321e39b9bb929d2e6a8e21bc9e
SHA1 6f9e5d695d7f916f623f23b980d87f8b967c7802
SHA512 8225d176f687f389e3c77f33276d873919f457c68dfe55ad30f4d53464ece3366cffffcdf43b1f7e32e86cc634d11171967d3e6836b7b60a4fc269177a158147
TLSH
T15711CE2915D13F67D3B1463B91E75332A6277D12F4A78FAE418C47805C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 172819bf666d385dbf383296a4631f657ac57ce8e841da266743babe54b88aa3
MD5 e4f66fb868bb7964fc6e028f22a5bacd
SHA1 669735acaa3b473368fd82c622396142f80ba882
SHA512 83506e0e198e0b57304be0d37090a014b76a430ed77e9702d40bbb6938a1f93f61f83eb19a541056819fe5d756784bfa5d111258eae12480841c643eb4fc0ce5
TLSH
T10C31E0198BD77B61F276D17AD6F24569E635BDE1B601FF4D005403480C31B40AA16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a417db4f95e46f7f839123960577b63b51cf3e5b42910ad2e52445e205063cf9
MD5 d42230e995d1bc07da791451017911d4
SHA1 ffc07d9c4ffb3e0c7f1cc47c364898b11d161be7
SHA512 fb0a7ce20bf19a864c645bea93cf3e123ec989a781e99aca183015cdc07dc0a76bcca0189a27286b829864ba14828728b854bd9fc347b9370a41bf1c9890f623
TLSH
T1E311AB2915D23F67D3B1463A51E75731A663BD02F4A78FAE418847802C84221981AF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9e9dfe296debb87a51f034cf53022c065d2a9cceb3d7e13d90cbb4a747762a76
MD5 50a6eca806a6a5bf26ea422f9b7bafed
SHA1 6bfe7916c7e5c09e4a9e31645135e55de9e31998
SHA512 83ec27b69f62267c29a1e8d9d1645fd8d9138ab1ad6c258d8b2d6cf9afd09e2585acd54b358cb5a53635e6db77d6f7a04bdc3e03d6d899d5d14a19c57d4ecbfe
TLSH
T1AD11CE2915D13F67D3B1463A51F75331A6237D02F4A74FAE418C47801C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0a5e232c86d49051a4644cdc1079bb8c665ee5c032f4b46dc2c5618dbf9a0793
MD5 f4b3be6590ac061559ce7d55f1704191
SHA1 c1b8defe029ad7e3481411e9000458c12895f5f5
SHA512 50e697a36c99f510dc2308dce5d1b6768f4ee488a5c8f322fae46bc9b73676c40a854d77f6f5f6534f8870eee270739567cc718a1819877cd7dd7888ddc72962
TLSH
T14C31E0198BD77B62F276D179D6F24569E635BDE1B601FF4D005403480C317409A16F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 530eb327702ac85489660683502870ed121499dfc68c882310ea301f313b021e
MD5 3d6d0868735491f2a4621ba4fd1ec618
SHA1 dac782bcb89f6b2825dd6b035edb252253babf1b
SHA512 72521e45ee34471411a88539bf5e4cc80bef8bfbe55830b094562a40b7185dc3a79c6b8255126f5b8f59a99e9a3d4b021a43aa38f0b68d837723cb20660b8be7
TLSH
T15311CE2915D13F67D3B1463A51E75331A6237D12F4A74FAF418C47805C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 cb7b7659fab38f10e453d98e055f00dcc0ee525e62ae9dad829a2dd35713212d
MD5 21260fc0f40e39c6235781df3d5be251
SHA1 1afba9e4974e152ba218941e0719bf0608d3056b
SHA512 677b5ad7eee7bab51673c7fded0ca869d69326c7c2e551faeab1548f6f647488464a64f090a2a623a26a3cb6a2b35e70d02f491429405964ef418f1b2098fc66
TLSH
T11D11CE2916D13F67D3B1463A51E75331A6377D02F4A78FAE418C47805C84221D81AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.6MB
SHA256 ed6c5b9c86e1ee26c72cac58b191d4a313af3e25b02da867d899a95c3176e877
MD5 2b868e227256fd435fdc805b4f2eaf13
SHA1 ae1402726584ff8dd47bbeab4fd6ce8b289fe6bc
SHA512 844197f308609938229bb8fec1a50258184b314a80cba303409cc2845863b3e469cd67f4aef33b3da88e98e1d5bd938bac40cf365b0c14dd58c50f8138094cae
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM62:+n6
TLSH
T186066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini.exe
Size 3.6MB
SHA256 02a69315aa6c5a8fc22c858332faa2ba58c75e53226dcaa2d5d5ee80abf6d0df
MD5 f4951d909e9032460ba63c0c5638f16f
SHA1 db5a1de0439757dd99daa883e259e0a39c7fda9f
SHA512 390ff5612063f676b156954766be8286c725e114bae175ce287537297bd36a0459bacadb65d8ffee8795ced6bd3f7a42af63d8a585d98f30d17ab0f1c166e3dd
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6+:+nq
TLSH
T197066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 3.6MB
SHA256 b6f612dea6805d7b532b5725487a6ed8d753f2736da9ff806b5df42017648eae
MD5 1fee6275739d6f8ab5fbc96fe631e53c
SHA1 7c4c217db89aeda79dc901dd46188025fafd9568
SHA512 d2b76d5993a4f7f34ec9447192ce69a8a5dc73dfb074f89086825b5f2e7982965519713e1da2e6e77b11e8954dafe4d0fbd8e935715ee77aa6054988fc920fbe
SSDEEP 98304:+E2H5Wky5WL5Wj5WiM+M6RkMkIM7M5WCMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6n:+nr
TLSH
T10A066B02B3E89425F0F72A305D76A7744A7ABC61AE38D74F3294750E2D71B81AD31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-67-0x0000000007630000-0x00000000076A9000-memory.dmp

Download

memory/1896-116-0x0000000007630000-0x00000000076A9000-memory.dmp

Download

memory/3892-66-0x00000000007A0000-0x0000000000883000-memory.dmp

Download

memory/3892-68-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3892-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4132-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/4132-50-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/4132-56-0x00000000008B0000-0x0000000000993000-memory.dmp

Download

memory/4132-216-0x00000000008B0000-0x0000000000993000-memory.dmp

Download

memory/4132-1-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/4132-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4132-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4420-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4420-57-0x0000000000720000-0x0000000000803000-memory.dmp

Download

memory/4420-51-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4420-228-0x0000000000720000-0x0000000000803000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads