Overview
overview
8Static
static
3ABDownload...64.exe
windows10-2004-x64
7ABDownload...64.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3ABDownloadManager.exe
windows10-2004-x64
7ABDownloadManager.exe
windows11-ltsc_2024-x64
7app/Compos...2d.jar
windows10-2004-x64
1app/Compos...2d.jar
windows11-ltsc_2024-x64
1app/aboutl...a7.jar
windows10-2004-x64
1app/aboutl...a7.jar
windows11-ltsc_2024-x64
8app/animat...fc.jar
windows10-2004-x64
1app/animat...fc.jar
windows11-ltsc_2024-x64
1app/animat...f8.jar
windows10-2004-x64
1app/animat...f8.jar
windows11-ltsc_2024-x64
1app/annota...6a.jar
windows10-2004-x64
1app/annota...6a.jar
windows11-ltsc_2024-x64
1app/annota...60.jar
windows10-2004-x64
1app/annota...60.jar
windows11-ltsc_2024-x64
1app/app-2e...ad.jar
windows10-2004-x64
1app/app-2e...ad.jar
windows11-ltsc_2024-x64
1app/app-de...1c.jar
windows10-2004-x64
1app/app-de...1c.jar
windows11-ltsc_2024-x64
1app/app-ut...9f.jar
windows10-2004-x64
1app/app-ut...9f.jar
windows11-ltsc_2024-x64
1app/arrow-...f0.jar
windows10-2004-x64
1app/arrow-...f0.jar
windows11-ltsc_2024-x64
1app/arrow-...2d.jar
windows10-2004-x64
1app/arrow-...2d.jar
windows11-ltsc_2024-x64
1app/arrow-...e4.jar
windows10-2004-x64
1app/arrow-...e4.jar
windows11-ltsc_2024-x64
8Analysis
- user interaction
yes - max time kernel
88s - max time network
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/06/2026, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
ABDownloadManager_1.9.2_windows_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ABDownloadManager_1.9.2_windows_x64.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
ABDownloadManager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
ABDownloadManager.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
app/ComposeNativeTray-jvm-a7f8d1fca19e8e18ddd74fe3ba639a2d.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
app/ComposeNativeTray-jvm-a7f8d1fca19e8e18ddd74fe3ba639a2d.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
app/aboutlibraries-core-jvm-225ee93bf4d2373655a49ac991ca0a7.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
app/aboutlibraries-core-jvm-225ee93bf4d2373655a49ac991ca0a7.jar
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
app/animation-core-desktop-1.11.1-3ec8687bba1c875f4630e7c99d49defc.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
app/animation-core-desktop-1.11.1-3ec8687bba1c875f4630e7c99d49defc.jar
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
app/animation-desktop-1.11.1-3b1636eba8fac16d053e567d9b91df8.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
app/animation-desktop-1.11.1-3b1636eba8fac16d053e567d9b91df8.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
app/annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
app/annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
app/annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
app/annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
app/app-2e695b23323b612d93a738780ad.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
app/app-2e695b23323b612d93a738780ad.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
app/app-desktop-6db5fe5c71c24092ca11cfb686b5f81c.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
app/app-desktop-6db5fe5c71c24092ca11cfb686b5f81c.jar
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
app/app-utils-2ad72a13e8942dd5bbb43ba6d2def9f.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
app/app-utils-2ad72a13e8942dd5bbb43ba6d2def9f.jar
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
app/arrow-annotations-jvm-2.2.3-857c7f7cfc297b186c96f34ce36f1f0.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
app/arrow-annotations-jvm-2.2.3-857c7f7cfc297b186c96f34ce36f1f0.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
app/arrow-atomic-jvm-2.2.3-fcdd2aa54ac9ac7a64d0e0f2abce762d.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
app/arrow-atomic-jvm-2.2.3-fcdd2aa54ac9ac7a64d0e0f2abce762d.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
app/arrow-core-jvm-2.2.3-51f4cb361b521378e540d1a07c2ea0e4.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
app/arrow-core-jvm-2.2.3-51f4cb361b521378e540d1a07c2ea0e4.jar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
General
- Target ABDownloadManager.exe
- Size 541KB
- Sample260626-jmh8dsav9r
- SHA256 61ad36f768a7668f54262a6ed52645bcaeac8f295916a1d6d94109577e2af9a1
- MD5 aa29041d5a2bad8a1e920093cdf4237c
- SHA1 d20d2295afd9f66f98f6bc14aedac25a086f7374
- SHA512 71dd96630bfd0962bc814073a69669c48c2fa8971a28a6860bbb4059f63bce13dbaaad48056870bbba57922d0d81e5a9a588fa10aed171750166307da19ddb73
- SSDEEP 12288:GpyDcGs+09VuYUY6kP7B6aCS2d2Sopm7E:rcGM7u9Y6kP7MTopR
- TLSH T1EDC48E16A7E842F5E077C6388B4B4543D671BC59037D932F03E2DAA59F27370AE2AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\AB Download Manager = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ABDownloadManager.exe\" --background" ABDownloadManager.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision ABDownloadManager.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ABDownloadManager.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision ABDownloadManager.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ABDownloadManager.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 6096 ABDownloadManager.exe Token: SeBackupPrivilege 6096 ABDownloadManager.exe Token: SeDebugPrivilege 6096 ABDownloadManager.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe - Suspicious use of SendNotifyMessage 62 IoCs
pid Process 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6096 ABDownloadManager.exe 6096 ABDownloadManager.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3048 wrote to memory of 6096 3048 ABDownloadManager.exe 89 PID 2804 wrote to memory of 5916 2804 ABDownloadManager.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exeC:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6096
-
-
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe"C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe" --background1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exeC:\Users\Admin\AppData\Local\Temp\ABDownloadManager.exe --background2⤵
- Checks processor information in registry
PID:5916
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\.abdm\config\app.port
- Size 5B
- SHA256 8ea5675a3d163115102f775c77790859e0abf7f7570b5260152516347f88fd38
- MD5 31981de171ad78f26b2cd0c7076d5527
- SHA1 023839680dcb1ba9c944bfff462665059646da3c
- SHA512 595a0e93e3ddbe2732e99451a99a6e57bcafa5c96fc2fb040d89025de1796a9a29605d6edc1ba35baf62a4fbb34150ebd734f335155b2c0241a17186789d5c6d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna10986008979442406178.dll
- Size 267KB
- SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
- MD5 2d2475f1f026dd54e9f3e787ae4f81da
- SHA1 27ff882ac271db547aee520b38e3ba9aa91e136c
- SHA512 07ef110d202d51f096a8b474d25c66b93b16af8b2ecdbf3ab23138273a0771c94dda6426fb644d43dd26cf53924f37821dca4c539d889d435185fff2198b3e76
- SSDEEP 6144:cZkI0LRMj+xkFxdHuGL0x65sz7QZBx4Cp+slm/mgye4:cZX095x65sz7iP42
- TLSH T1BC441917A7B648E5E9B7C03D44236A16F6B178294320EBEB47844A531F73BE09B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tray_icon_4942508560928035933.ico
- Size 1KB
- SHA256 c39e2ad9f72929912b3181f55e299145398d2f0a65755b18171d07d1f01d5495
- MD5 578683f8c5f2a55d82aca5479a67b521
- SHA1 64472715fb38960ec4f688fdc61bd611a7cf83ae
- SHA512 8eeec38d923be4015d09321095a03534e9e41f45c9e53d098d4e5e9b0fafd504b5081d94ef547b8579a16951008bb87c0214436f7ad9b90472b1fe7c84a5a6f0
- TLSH T145310CC847EC3593192F42E7D39A0051CDD2ACE1E8247F99359DAAFD04453A516AC64E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\composetray\native\win32-x86-64\WinTray.dll
- Size 22KB
- SHA256 160734faa38e576c02d5d9320eb288576004ed3935e3c212923180beca60550c
- MD5 ef21a25933cd7feb1123563fc704365d
- SHA1 3e6bbafcd3ee21886764cf178dd8eb3a20c33b91
- SHA512 33e15ca21138a0d128b9a99c1f3839325117039c77d029a0b1fbb7d8f40446b36cba564c31978101b370928ffffe108b1c1a86a580a3d662220fbbe52937bc43
- SSDEEP 384:gPwptL7/2ZvXLP7SP+CvLE9ke6mvzodLGXYPAgeJru2LKKlccungZ0xQJFDdX5Xj:F/2NHyeNbodLkQeJye78p2v
- TLSH T14FA21928D668484AF575D23CC4BA162AE0353819DB72EBDF5320823D7F736E3863D182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\nucleus\native\win32-x64\nucleus_windows_theme.dll
- Size 5KB
- SHA256 234475f1ed81c4cd8bac77051045aa565d0c7f560bf4166c89d279f7c3cbf40d
- MD5 863733ca83b754662057de6b533e7ce1
- SHA1 b4c442af9901aa1b721de53d2bee7376d04dfba5
- SHA512 5ad572e7ac3f9878f7aefbe16bfd086971d5c3fa7aaeed5878e96c352ec6b7e08a057f845586b05029e6b5eab21c3589067fdc1d040b768d131da9dfcc3740a2
- SSDEEP 48:qUf1KceE9zNUuG5BaIZmfgXayee1voGU4fjN6l1vqxhoE:9f00Nom4Khe1NOhK
- TLSH T11EB1644777E048F3F82D11F9CD6B428C929CB1D38961471A479C544CAE81E273F2EE86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3226024100-3888324339-2736661264-1000\83aa4cc77f591dfc2374580bbd95f6ba_b53d21ab-190f-46e7-a216-10b8f3a4a3cc
- Size 45B
- SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
- MD5 c8366ae350e7019aefc9d1e6e6a498c6
- SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
- SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
- MD5 SHA1 SHA512