17efcfedb6075fddb731022d67263888a9aff04c9134cc0f1a198f8751ce1761

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 45.1MB
Sample260714-ejxt6ady5l
SHA256 17efcfedb6075fddb731022d67263888a9aff04c9134cc0f1a198f8751ce1761
MD5 4fef66724d8ed055293e6a7f3a092645
SHA1 731371a6b1a1f1e14c245147933c1f15b053a757
SHA512 e001a85984b942ca042577327bb4d63af5f03e94ed7c243208c8bb60b106d7783bae3f6fa4f6590e34aaf14fc16814bb72f294b0e76a3fe3778a95b52c8c5890
SSDEEP 786432:HtAtOqx19MHZrnKFtUfDkXbAWon9GYMuSxoXM2do7lzT8kEXEq5kXB0WwFIE:y39MHZr3fQX8oYMuSb2dU/YEt0WwFL
TLSH
T1A6A7336562B414F5C1B38376D9949572EF75784E233083EA96A8C62C2F27EE12DBF301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1620	WirelessSetup.exe
3480	CoreBA.exe

Loads dropped DLL 3 IoCs

pid	Process
3480	CoreBA.exe
3480	CoreBA.exe
3480	CoreBA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CoreBA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	CoreBA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CoreBA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	CoreBA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	CoreBA.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1620	4504	2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	86
PID 1620 wrote to memory of 3480	1620	WirelessSetup.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Temp\{967F6B9E-8F9E-42FA-880C-986397FD22AD}\WirelessSetup.exe
  "C:\Windows\Temp\{967F6B9E-8F9E-42FA-880C-986397FD22AD}\WirelessSetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\CoreBA.exe
    "C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\CoreBA.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9AA34D0A-C02D-407B-8E3F-A28A0CD105AD} {3BCB6039-4FEE-4093-A234-F2B30F0D776F}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar_20260714045904.log

Path C:\Users\Admin\AppData\Local\Temp\2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar_20260714045904.log
Size 10KB
SHA256 e3e382f13fd5820bce4fc7846831b099a97220a3c0ef46f14e29ce0e8bc6040e
MD5 b784595b16f1289507482f4683dd04ae
SHA1 26eb4ace927bda080ca0b1d15113be03b543dcae
SHA512 0cd8d4fe83f2a85e4da3441c3b5912b668d86623e07ff4d79ddcd5ada72af9a42e7a25e8623b912b42f1687f91628b6b138ea7fd2b5c5aaec52e0762ed46cbe8
SSDEEP 192:EUgEI+6+i8QTMAT+gatQm3aJl6hKZBpLDBGMcssuqGRam5amiaTajaoahN1BpB8I:EUgEI+6+i8QTNT+g4Qm3cl6hKZBpLDBV
TLSH
T1DF3217A31BC964D839D1A622622C7BBB9B56F363608C06B0337D2360DFD590F5A9F153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\BootstrapperApplicationData.xml
Size 13KB
SHA256 e0aa224ec997112d6950bee8003b85e55b49c43724c4457e0f46e10b2c06f1c3
MD5 b28c7562b4c97f89785c8db6df82a795
SHA1 8e32caab712c28f239a27ada15ea48017839ae28
SHA512 0ec0e1ce938a9d02a9a384830f853242f49548f72b0103480a6ebba0edd66d3b1fb897c987e5caf3d913081f8448c9a45143c08ee73ae06901e79677c3c1de65
SSDEEP 192:xKPDyoh76gH9Zj5RSAK2+QWa0tqkAYuPld4y/lwfUyIo2V4yY80iN3mvaCnRCxzj:IYNah
TLSH
T16E52B5593BFD0118F0F38B88FAB955955B79BCA12A38C85D00612D0E4DB3E429962FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BundleDefinition.xml

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\BundleDefinition.xml
Size 6KB
SHA256 9fd9e22b990dd99314e0dac88154a77961bb0a62fcf647e18e19183babd96c40
MD5 59b5222c74e9daeaeae57b8de8789d59
SHA1 a410ec3e6d21958266564cf2343891181f1834bd
SHA512 b4a323d738082bf0fc86ca54b533689327441e53b7e8f5acbdeb8f1913c08a4a149740fc46780177a35cb7cbd4f387a9005c71e15cd6811929a691ea20276ed1
SSDEEP 96:jf6JngcpZTbikiKbsnfcoBUbn6HdCKyQxGVEIPY5iAphG0f/iOkeEc:Nj02nh3ibeEc
TLSH
T1CFD13B67DECBF4676B2E9369BD13D64A9C3480DB10196782B09D52071F3F03BA193A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BundleDefinitionSchema.xsd

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\Config\Data\Schema\BundleDefinitionSchema.xsd
Size 12KB
SHA256 4e1713b6691a1c0842240c3b783f97e06f2cf8a31be8a9e8ca44f9d9587f2976
MD5 ff590a29b95670711081119a0e8aee15
SHA1 5ee8eee2724c199bfd62029542c0c18d84c51b66
SHA512 27d512e7bc050603e55deb451e65b7eb3bdf2bcc2691e5a30c98eaedc7e0a99e2ceb044dfa05511d82a8b48aeedc3c0f9afb998fe19da3e0682b5892e39535ac
SSDEEP 192:8oDpnZTDpuDUpbvDLDpLSH4n70VtOlZr5cS/yycFpTL+Y47LP:8ob1prH7VEeF
TLSH
T1514229DA71C0DE1A0D3B45748682390DEF15913303A42EB0F4DCB3779F7AA458A6B2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BundleSettingsSchema.xsd

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\Core\CustomBAConfig\Data\Schema\BundleSettingsSchema.xsd
Size 2KB
SHA256 2b531e8eff92ada9ed484349c8edc403165f9f1c5d0c763e9c20f1d0cef277ec
MD5 3543268dbbea7ca61a1a6661d7b22b15
SHA1 e12acb66190c96dcdfe67fc458c070b9ea8c7861
SHA512 6add5d61f4a684c4a67c136f133367943296808f427940751e41a9439ca751eda5627db93ac319af37aafad6e5e169ee3502f746c478e3c97625e2ea1f04d55c
TLSH
T10D4125CA35C1DA050A3B0935A692270DFF99323302E82CB1F9CC5763AF759C212A72B4
MD5 SHA1 SHA512 TLSH

Submit Download

CoreBA_en-us.xml

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\Core\Localization\Data\LocalizationXml\CoreBA_en-us.xml
Size 12KB
SHA256 9a6587911ab3738551ab65af32d9672ec0a4123b407b79eda068c0a6c30bf242
MD5 e04ca45c8498afc0f39344bdcb1bfc9b
SHA1 f93d175347d92cb6084434775bcce36c8c267252
SHA512 6333662a2c55d57917315467c07f2d815e986b8af971a01745dd017e507a37ebe22b476f7f6505255c5d775c9c8e07c7bb2428565ff52946dea58dcda09978a3
SSDEEP 192:vbhUQvSLOvCKnfVnwn2KRHjRhsDEMtUhNfvMmo7mzBTXvWOJbcV+VV:DuQvSLOvVVROjvelUhNfvT28x/ltr
TLSH
T198526C1E7B9A52D128722269DA9504BA991940BF433306F5FD97712BCF6AC224373F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizationSchema.xsd

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\Core\Localization\Data\Schema\LocalizationSchema.xsd
Size 1KB
SHA256 04b5877bb219d308b4700db36c894b9e3dbd2b34978868c9bbcc27d0be7b3bd0
MD5 5b229e7af30dc2425806de351aded129
SHA1 4c349460f77ce7c5309e7365c20fafb6ba9f3f2a
SHA512 7d9e342579af8c6ed87003df69ed0ba8ebf9135b9e825f3cf7285fd3daebfca3b45e4e57da26da9d0243c57e7a2fba94b05f19e90e44f75ac8a12064235c886e
TLSH
T1291148E670C1CA054E3AC972AAD13509EF55A17B03A42EE0F8CC93A75B755C306673B4
MD5 SHA1 SHA512 TLSH

Submit Download

IDK.Common.dll

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\IDK.Common.dll
Size 43KB
SHA256 ba17f5c6c67923229660e899c8f2365f513e78f5a4c5862ab19b7fe594dbef3d
MD5 636f934a5e3dcd077b9a8e99f0d1257e
SHA1 40e05bca5701097b8823d22702386f93ef58f39c
SHA512 485072645474432b3a4bd7e022912e34d71c5ed66f063bc61b15428c48f626f077919d812dcbd988a7515b30407757787781c7303cb0864af92b76b68a315da3
SSDEEP 768:q3blqlHXAr9umnY/UcQRhueMLmqXsFLBFXFAtU5FMTHOjuYlFVFWFDboggMzoze1:QRrOmnezo6VI8
TLSH
T186135C0923B95124CAE68FFAF5F3851109F3FA9A3922D5A95DD290CD2D5DBC33202837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WirelessBundle_en-US.xml

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\Localization\WirelessBundle_en-US.xml
Size 1KB
SHA256 7d55bcc9db03b82b04bbb745cfe11026bd526a49c4b4edb5c3b7b2cc7e7133fa
MD5 a8a6e37fb065cee0791d3de5a6e62d6b
SHA1 9db64dc2e1b783d9b3f2a69e1b56a5f3cb096117
SHA512 9a153621468dc8f558c223d99a0cd25004162400016fd1a18ccc70caf0fa0d79e2098d0fb9791b0e07d2a32d16b7d3a0629f1fb3931d22b41f8cb1ac8e200c09
TLSH
T1362178C67F676080163BA5329E6680A5A92F41DE51B516E0B848313EF3CA87A133AF65
MD5 SHA1 SHA512 TLSH

Submit Download

MaterialDesignColors.dll

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\MaterialDesignColors.dll
Size 321KB
SHA256 cd4f59b1d65c315ee1559d1c0616fda9eae2079a0e185b0a2c56976f659a258a
MD5 bf01060c8f386521e6d6c4db4438ba75
SHA1 abc4a9260bd95631e14144e5fb42b382bb851f64
SHA512 cd876e589bebc22b6f5ed6f61016c5c8bdc95194d33ba265d474fb457a92fe74545950312aafdee042d6cf74b82e99c6e3b16a9f5a2566b5c81ffd2a667742fe
SSDEEP 1536:7YU43cN+zeRfPl+aN3ie+WQ4LNgXDB66af/4Qo4Vm:aQfPlTBi3d4LNgXDB66af/4QBVm
TLSH
T12C64975C125490FFD817967A0838319972233A7A6B994F8BEEAF33FD8C1510B5B331A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialDesignThemes.Wpf.dll

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\MaterialDesignThemes.Wpf.dll
Size 9.5MB
SHA256 7c3979f5849b4ce7b0743d2abff8df9dbb2f6949c4725ea06e5f757ec3debd61
MD5 bd87796895d40df6ec1db553014cfc4a
SHA1 57111c88f9f999ed2db5bf2ce19592d4a550b57a
SHA512 364d458136ec5239d63415d94b91287a8f03ac4837ea09d10246d9bf5d0a567344e2afc6ac367aaeac557805914e8aaa1154a01b874b640994f2f053398da01b
SSDEEP 98304:7uHXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCR2fSe:6nJ45/9iD54+V11bFv4z/
TLSH
T165A6D92CCD05A727E2B7C264809E0A17F1A2856AF5394F0E70CB1B693647A437E85FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.BootstrapperApplicationApi.dll

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\WixToolset.BootstrapperApplicationApi.dll
Size 168KB
SHA256 afaeff3e1c543eb93dfe048de02fb932d8c864a3f2d3340de4dec4a3daf2c858
MD5 e838f3766485a48df018928b2c17378a
SHA1 6b8a9f09884022ccdf34db316f96b333dc8a97ea
SHA512 318ed441ed8a4f60544d27a40349f08ce6b081184203cd02c405e5df1a980e8dee3c0c7487c14b069e80663c3b9fe4320cabd1de9faf315618db33b822ac7efb
SSDEEP 3072:AyBmMtVxcKhL+N5KpjjV10d15g9clpLk9zwdGgJhu:AKFWK2oNjVe15gelpI9zwdGgu
TLSH
T102F3181543EA9173F387793EE0164B5386BAF98914A1F3A956219CFF2C337061921BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WpfAnimatedGif.dll

Path C:\Windows\TEMP\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\WpfAnimatedGif.dll
Size 53KB
SHA256 9d1d74cc2ef5947583852a44a72b060c867fa729315d0c51524653fdb72b1f58
MD5 6f8f5c379e5aa670aaaa80734ab6730f
SHA1 6b5b243590d0e31657e2d2414a02ecf3dc327dcd
SHA512 0c2026874dbd4cbc85cf2cb338dd9183ae40f0b9998ddd511e5a6c563eb6b460594a7a8f82b528f77b2622b20c2a391bd48e91ad408002c21ac7c47adcc44aa8
SSDEEP 768:HWqVzu6KJSlJ8Mcbxme9+tyvUsrYZmit4sozCAmbLV:HWqVzu6Kkj8M6xl6yXUZssoGV9
TLSH
T1FF336C912B7F826BCB5E4AF9B4F0411605B1A35A7922DBF7AE6494BF1C563C003182B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WirelessSetup.exe

Path C:\Windows\Temp\{967F6B9E-8F9E-42FA-880C-986397FD22AD}\WirelessSetup.exe
Size 44.6MB
SHA256 aa3c37125481c14105af7e58c27d2b3f8799f9cee1104445552b20700340f60a
MD5 77b27436cc2438b8a1fcf3c683401102
SHA1 20ed194e8e2ef5579c4340ea879e22de22263eec
SHA512 3478cba10f8162937d9f21b55300e0d93147d36c1d7a63fc5237db747c1b8eb327b63f1366168b225a5afde988bac5a18f50557395ade42ab6851c2aef00d500
SSDEEP 786432:+tAtOqx19MHZrnKFtUfDkXbAWon9GYMuSxoXM2do7lzT8kEXEq5kXB0WwFIz:539MHZr3fQX8oYMuSb2dU/YEt0WwFk
TLSH
T131A733B4627428F5C1B28776E590D5B6FF74794E233043A9CA68C61C6F3ADA029BF305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.xml

Path C:\Windows\Temp\{967F6B9E-8F9E-42FA-880C-986397FD22AD}\setup.xml
Size 27KB
SHA256 beee1c57e062089f8e55a3f39ac1bd66e42ec828886d022208e0d87a76c4f069
MD5 6ca34a6e37b58c8fde2c3b56dcf96bc2
SHA1 228c611d21dd93cb577eb2dda0d751fee3c8ae68
SHA512 3aaeda1ebdb076ddf55a14ea2989b009f577b7a915a19b0fc7b66c55ca4ab7b4a16bb7f83cca46496a85ba08b219f76463bf98d3f0d269b358c3eccda7a83d05
SSDEEP 48:cB/2EHJbT3EhIKijyeyay3yqyhyPhbehbahb3hbqhbhhbPPePaP3PqPhPPgegagj:IrpbDUVZsJW8fvezQGD/mPgI
TLSH
T10CD20A1128D518A5D4D3A68B9CED3CF6CE8631BEB40C71A1FACA5B4D1B9B2535D23332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonUtils.dll

Path C:\Windows\Temp\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\CommonUtils.dll
Size 162KB
SHA256 8b748cbaf6e46897db3569647427849d2be6a8d50b77696f0817cac7fe6a9c81
MD5 fc4e4563afa50fd6514c9ae1d5808765
SHA1 6df95f0678ba79464dec7ce01c59042147efd9f2
SHA512 6de4be926b6bccb763088a6e092becf0a5360d80bd172ed0e4784fd520eadc646fe5ff4cf89de2f6090ce6566c46a812b4bdd378d42ecb37ffeedcd4afe7fae5
SSDEEP 3072:SAlMJ+XRdp8764vkpr0y023PLKkLClUkkil8hkJ38fVUI:/MJydp8764vm0y0oAUROJMfVr
TLSH
T1BBF37C41B3F49A55E8FF07BAB87445120FB1F98BA532E7AE5A80AC7D18533418DA0377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreBA.exe

Path C:\Windows\Temp\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\CoreBA.exe
Size 783KB
SHA256 741c0614dc359feb74014d85b6dc236901add093e9602e4850e917be4bb6f030
MD5 1b9bde80ba756556d7db580aeb009ad1
SHA1 d6673dd270e158ba67478e47234a5f50f08ae4c3
SHA512 13f1fefceea95d8b8e2b5262a505bdc866969f7d598c88dfeb59c15d112da7c797ccc9cb964e50f5b88039ec6baddddc3ce23ffa8ec6cce1e48539f84ea638d6
SSDEEP 24576:sUdMknsfkxE8o3ppl4h+D0dxHK9uw2cVB:mFkxToZoAgdxHK3
TLSH
T19705E01133FC5129F0BB5B75B57605108AF6FA875A39C26E380C3A5E57A3B42A522B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\EULA\el-gr\license.rtf
Size 268KB
SHA256 718bd1bde02c13688f9b48455468982386ab74462face0fe32006ef2b5e93a32
MD5 071dbfa6642999d78abaedf237aa83f7
SHA1 6d6efe62173116665d2d1a69e91e6e3f1061a239
SHA512 97431e6ec5b94e4b24ed5bfb9fb4b9800ac2d1e1c867e3c73d1104f6cf52c8e563791a279d27d31ddad43c11b6ca4c4035d45cffa2830dbc299f3fcd809319d7
SSDEEP 768:rK8Hw4elzw4P764SIgW26vW8KDmGi62zHfIGWV6eWLKkmWiC2eIUYzpA9UCpWwY4:rKc4t6VDfzigljxkg2JpgnQ/0tg
TLSH
T1B744D3BC188AE3D5F3ACD34AEC57F4CCEC3680603119C592636685AE509FD2C996D36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbanative.dll

Path C:\Windows\Temp\{C9B8B5A0-B470-46D5-BD51-C1DBFCBB0257}\.ba\mbanative.dll
Size 305KB
SHA256 e92d832d7bceee2356d2229b1bf3e041049ac49bd3147f788a4ed368caa4b982
MD5 eab8dd5bf7a4b455b939858ce1222b40
SHA1 6810c1e41c435935df0b969a9e22537c05d23853
SHA512 7e38f61d872cf42f2a4de94a6a8e7fae3e6f4c5011ddbf69d103a179aed8315a28e20544787e845b5aea747870e5d72572395e96b6206448ee7766569f94612a
SSDEEP 3072:7EMIIfKrJLIaeIjzDZYIwegry+nCfdO/JPETxlVk7yrRaczcpbZrDvnzALwzzoP:fLfeItKV4egry+jJsnVk7MaDnvkP
TLSH
T13D643B6422B414A9C5F956B9DAC2B122FFB0B54C230091DB83548E397F3FB9926BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3480-253-0x0000023FC3A50000-0x0000023FC3A60000-memory.dmp

Download

memory/3480-274-0x0000023FC63A0000-0x0000023FC63F4000-memory.dmp

Download

memory/3480-241-0x0000023FC38D0000-0x0000023FC38FA000-memory.dmp

Download

memory/3480-242-0x0000023FC3A50000-0x0000023FC3A60000-memory.dmp

Download

memory/3480-233-0x0000023FA9410000-0x0000023FA94D4000-memory.dmp

Download

memory/3480-235-0x0000023FAB180000-0x0000023FAB1AE000-memory.dmp

Download

memory/3480-243-0x0000023FC38A0000-0x0000023FC38B2000-memory.dmp

Download

memory/3480-246-0x0000023FC3A50000-0x0000023FC3A60000-memory.dmp

Download

memory/3480-254-0x0000023FC3A50000-0x0000023FC3A60000-memory.dmp

Download

memory/3480-271-0x0000023FC6C50000-0x0000023FC75CA000-memory.dmp

Download

memory/3480-276-0x0000023FC3A20000-0x0000023FC3A30000-memory.dmp

Download

memory/3480-245-0x0000023FAB1B0000-0x0000023FAB1BE000-memory.dmp

Download

memory/3480-277-0x0000023FC65C0000-0x0000023FC667A000-memory.dmp

Download

memory/3480-278-0x0000023FC6820000-0x0000023FC6828000-memory.dmp

Download

memory/3480-279-0x0000023FC6870000-0x0000023FC68A8000-memory.dmp

Download

memory/3480-280-0x0000023FC6830000-0x0000023FC683E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads