d98372b44be58ede2463ba80fadc691d2da7512dd18ed2ac2752660b01e049fa

Analysis

max time kernel
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
Size 953KB
Sample260707-ef443aht3x
SHA256 d98372b44be58ede2463ba80fadc691d2da7512dd18ed2ac2752660b01e049fa
MD5 4f6867d40fe7d831f4a65b0c5c1b86ad
SHA1 5a1ea3d8ff34084ce8b93714d67216d544a0976c
SHA512 ef0517cc7c2aa4984c79c80df5b603638e539343e1cb22a2bc9ba25ad1d73fc4ff14f4ac5e6fd3e88f9762bb5e7efe35f62023da7e29ebc2e09fb2e3dad18ae3
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCbc:7454GXFQRlpaewsAjgYKiI+lDGCbc
TLSH
T1E125AE21FBA0D036D27B0A715A66D321657CBE310F5146CBF3A85B8E5E702C26B36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3760	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3748	2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
3760	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_4f6867d40fe7d831f4a65b0c5c1b86ad_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3748

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 953KB
SHA256 d98372b44be58ede2463ba80fadc691d2da7512dd18ed2ac2752660b01e049fa
MD5 4f6867d40fe7d831f4a65b0c5c1b86ad
SHA1 5a1ea3d8ff34084ce8b93714d67216d544a0976c
SHA512 ef0517cc7c2aa4984c79c80df5b603638e539343e1cb22a2bc9ba25ad1d73fc4ff14f4ac5e6fd3e88f9762bb5e7efe35f62023da7e29ebc2e09fb2e3dad18ae3
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCbc:7454GXFQRlpaewsAjgYKiI+lDGCbc
TLSH
T1E125AE21FBA0D036D27B0A715A66D321657CBE310F5146CBF3A85B8E5E702C26B36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 1.0MB
SHA256 735cd1f8e5ca14835553aac25b638060d918a480703b9feb835299206152b029
MD5 49674f6af6c79fbe992544c8d322952a
SHA1 5ad52eeb644194f10f06f7b73a118980701dacf0
SHA512 b3af46610ef7ab8da0c200200de0b11c4c95b6a631f8dc7dae0e1a01a034a0d2dbc5b833d0a344a9f6cb7cf0d2bd08de1b4efa52945c34a1bf7b0dd638435e09
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCb8nRpAr4w:7454GXFQRlpaewsAjgYKiI+lDGCb8TjE
TLSH
T15735AE22BBA0D076D2770A705A66D7116B7DBD310B5147CBE368478E1E312C26F3AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe
Size 1.0MB
SHA256 74ff0c26add812735fab0c2eb591f18e75a6ffd7e2af5bcb6892ba120b64815e
MD5 32157c302d3637cb7b39d9d1a8f75751
SHA1 e4076539c18a538a4523535044842d6c3e9059c1
SHA512 49187f461a2f3be0503183402ac70a312eec602aad3e4eae6775aebcf17af1365da838731a57c371fa5ce86614b6444f2cc0ece8cd454a44bd1a786a2d85a1d4
SSDEEP 24576:7454GXFQRlpaewsAjgYKiI+lDGCbEv7MFi:sHF40ljve7gi
TLSH
T1F535BE22BBA0D076D2770A705A66D311667DBD310B5147CBE3A8478E1E713C26F3AB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 7207472c6ae8699513af172eba341cdb90fddcb57db9cb96e07da69b25bf6229
MD5 ccfda6fdb12dbe91c5628d49d05ba01c
SHA1 73cfa5bac0fe2f84e495222bd26ab4f82282667a
SHA512 2ce64f34f7286c0c668dcfe7032e1ca989e2a6be9102a84726952dfd4fb694fc1cb8fdce324fd0f79169d04b456694c9d13c3f8f0041feda362e5b6c9490be02
SSDEEP 24576:7454GXFQRlpaewsAjgYKiI+lDGCbk0Le5ji0hmxNrM:sHF40ljv+Pji0Aj
TLSH
T18C659E21F7B4C232D07385B5C9E2E75AE97535510B308ACB9398876D2E337D29A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 968KB
SHA256 1fe2a85128379fb4b2aaddadbb9f1bda5403f8ce480d87e8fa4428f8cf33a72a
MD5 13db88cf8da9576602fdda420f85e741
SHA1 75865b254f3996274073f70781a4265be85e9955
SHA512 8976c1e2280db45fb7baf32d0715f1d11a29fb5d572bc8b5c7e99d65af32ff377f4d953c69354eaf4e426b8bcdd8272a0d31600e79c7e18584e38a3bfe28c615
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCbOa:7454GXFQRlpaewsAjgYKiI+lDGCbOa
TLSH
T16325AE21FBA0D036D27B0A715A66D311697CBE310F5146CBF3A85B8E5E702C26B36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.NetFX40.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
Size 974KB
SHA256 e16a54369fefa069c0373452523a8bbbe890c1d16f94e3365b0648f2fc452119
MD5 be53a3fc8abc14cfaecfb781988160fb
SHA1 ee83a6138b33b052610fba6c6f4d7e842615bc00
SHA512 9ca2e818badf940bb3dea903f0ccaaa359188e32ba4a2d3ba3cd5fbfa5b3a0ae0456eb3b821b83afe5dcc7727ba494d6479be0319549277b1371b12726ffda9e
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCb9:7454GXFQRlpaewsAjgYKiI+lDGCb9
TLSH
T1AF25AE21FBA0D036D27B0A715A66D311657CBE310B5186CBF3A85B8E5E703C26B36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.NetFX45.exe

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
Size 974KB
SHA256 e2994403d068a802124240338dcc6dcc0af347d6935ccb96b5c91b94e4bc39e2
MD5 0e24ad08007ffe1bfd1859a456579578
SHA1 6f351003f1db07a699e4a0e77809e11dfbb43446
SHA512 cbebbe0dfeb4f4372b542f0d907f52526e04b2658860cd6c23742e275887cb2792953304333f98809469bef38f127382490c93fa99d169e6b47a927ddf9df8b9
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCb904:7454GXFQRlpaewsAjgYKiI+lDGCb9j
TLSH
T1C125AE21FBA0D036D27B0A715A66D311657CBE310B5186CBF3A85B8E5E703C26B36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 1.0MB
SHA256 3ff68155743048ac6c12c75431567ae4041db927b98fb44de5dbc9d8e45f75a7
MD5 6e03750b2162c0c7117610e388cc7894
SHA1 8e6abce34aa0d73ba736c867479258406c4eefbf
SHA512 c79df9a2ac804e4d4923725477f41e9b35aa34ef19e09a58c4fb3e2a9eeee28f69cdec0374db1f6c0170082c65372408fb0cb62cc550f7a650fa07770d79c5e2
SSDEEP 12288:7454G2nCFQRlHUAwSfxL/2Dc3jDLLmt0LDQewsAjRd0H4KiIQ28lDGCb2F:7454GXFQRlpaewsAjgYKiI+lDGCb2F
TLSH
T1B8259D21FAE0D032D2B709309E6AD711657CBE610F514ADBE3687B9E9D302C27736B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3748-1-0x00000000006E0000-0x00000000006E3000-memory.dmp

Download

memory/3748-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3748-24-0x00000000006E0000-0x00000000006E3000-memory.dmp

Download

memory/3760-11-0x0000000002040000-0x0000000002050000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads