Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
- Size 5.1MB
- Sample260716-b8brfaay2m
- SHA256 d375c3c77cc650309b9335f845840aa9a2a50fd15b3316f100251ac67d8cdc55
- MD5 6f4cdf883f93bde7103aaeb81d8d3eae
- SHA1 d632b13c90359d5e5e689c34c93f74d3ff679192
- SHA512 8a5e4577034a09a4e04f50ee69f786302d0e76195c784ea82599301925d886cc7313b3b7b959d0ff4655160d51511e8e9c1f6b0e2664ad8fd5ef7037d1aea29d
- SSDEEP 98304:KNpLqF7l8AT8j0Vtz58AEpbEv3Fck3fEi2puKKeHn:KNpKij0JJEpbEek3sJ5n
- TLSH T1CE469E127AD08072D5A70634999AE675767DBC301B3582CF73943B2D2E323D25E3AB27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 10 IoCs
pid Process 3456 regsvr32.exe 936 regsvr32.exe 2148 regsvr32.exe 4904 regsvr32.exe 5776 regsvr32.exe 3100 regsvr32.exe 4428 regsvr32.exe 4884 regsvr32.exe 3560 regsvr32.exe 4084 regsvr32.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\OverlayIcon2.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\AddIn4Excel64.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\OverlayIcon264.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\Core64.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Core32.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AddIn4Excel.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AddIn4Word.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Tehost64.exe 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\AddIn4PPT64.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\AddIn4Word64.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MsgCallback.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AddIn4PPT.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OverlayIcon.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\OverlayIcon64.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File created C:\Windows\system32\MsgCallback64.dll 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BB64A73-2645-4ACC-893F-4088DC828CE2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OverlayIcon2.DLL\AppID = "{C9B3BA52-8619-4032-9B3D-D373AAD7F1E8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1ED0D91-0741-479F-8E39-20783E394BD4}\ProgID\ = "AddIn4Excel.SinkEvents.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCDE86B6-C08B-43DB-9FC0-6EBAA7A319ED} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F42BB601-F3B8-40CD-8A80-3FA676650932}\1.0\ = "overlayIcon 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F42BB601-F3B8-40CD-8A80-3FA676650932}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OverlayIcon2.DLL\AppID = "{C9B3BA52-8619-4032-9B3D-D373AAD7F1E8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8858B4FF-3C41-4922-8475-71BA24DE6FAD}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0E0994C-65B2-48B8-AB35-BABC64AE9104}\InprocServer32\ = "C:\\Windows\\System32\\AddIn4Word64.dll" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C17B28EB-B59E-4447-86A5-0FB6B4B84CE7}\ProxyStubClsid32\ = "{C17B28EB-B59E-4447-86A5-0FB6B4B84CE7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9857F41C-198A-4592-8A35-D6E1CBD3353C}\TypeLib\ = "{7B40D142-54D1-41CB-BEB4-530FFA157C39}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1ED0D91-0741-479F-8E39-20783E394BD4}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C17B28EB-B59E-4447-86A5-0FB6B4B84CE7}\TypeLib\ = "{8858B4FF-3C41-4922-8475-71BA24DE6FAD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B40D142-54D1-41CB-BEB4-530FFA157C39}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DF8FF5B-6038-40B5-ADC1-D42056D4E9EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\overlayIcon.PhoenixOverlayIcon.1\ = "PhoenixOverlayIcon Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\InprocServer32\ = "C:\\Windows\\SysWow64\\AddIn4PPT.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCDE86B6-C08B-43DB-9FC0-6EBAA7A319ED} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\overlayIcon.PhoenixOverlayIcon.1\ = "PhoenixOverlayIcon Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BB64A73-2645-4ACC-893F-4088DC828CE2}\ = "PhoenixOverlayIcon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon2.PhoenixOverlayIcon2 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DF8FF5B-6038-40B5-ADC1-D42056D4E9EB}\TypeLib\ = "{7B40D142-54D1-41CB-BEB4-530FFA157C39}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\overlayIcon.PhoenixOverlayIcon\ = "PhoenixOverlayIcon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9857F41C-198A-4592-8A35-D6E1CBD3353C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1ED0D91-0741-479F-8E39-20783E394BD4}\Programmable regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0E0994C-65B2-48B8-AB35-BABC64AE9104}\TypeLib\ = "{B5A0D674-E1F2-4118-A2F4-CFA79E8330A2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F42BB601-F3B8-40CD-8A80-3FA676650932} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DF8FF5B-6038-40B5-ADC1-D42056D4E9EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{486ABC90-A552-408D-8436-C11B1B5AF15B}\ = "AddIn4Excel" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\ = "SinkEvents Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03B99749-50FE-4A16-9689-7036A0B4625A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\ = "SinkEvents Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCDE86B6-C08B-43DB-9FC0-6EBAA7A319ED}\TypeLib\ = "{B5A0D674-E1F2-4118-A2F4-CFA79E8330A2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCDE86B6-C08B-43DB-9FC0-6EBAA7A319ED}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DF8FF5B-6038-40B5-ADC1-D42056D4E9EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1ED0D91-0741-479F-8E39-20783E394BD4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1ED0D91-0741-479F-8E39-20783E394BD4}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8858B4FF-3C41-4922-8475-71BA24DE6FAD}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B5A0D674-E1F2-4118-A2F4-CFA79E8330A2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C17B28EB-B59E-4447-86A5-0FB6B4B84CE7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\overlayIcon.DLL\AppID = "{8111E51D-A28F-455E-9B2A-25D2D26C1361}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6BB64A73-2645-4ACC-893F-4088DC828CE2}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0E0994C-65B2-48B8-AB35-BABC64AE9104}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8111E51D-A28F-455E-9B2A-25D2D26C1361}\ = "overlayIcon" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\overlayIcon.PhoenixOverlayIcon\ = "PhoenixOverlayIcon Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\overlayIcon.PhoenixOverlayIcon\CLSID\ = "{6BB64A73-2645-4ACC-893F-4088DC828CE2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F42BB601-F3B8-40CD-8A80-3FA676650932}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DF8FF5B-6038-40B5-ADC1-D42056D4E9EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8858B4FF-3C41-4922-8475-71BA24DE6FAD}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C17B28EB-B59E-4447-86A5-0FB6B4B84CE7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0E0994C-65B2-48B8-AB35-BABC64AE9104}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B5A0D674-E1F2-4118-A2F4-CFA79E8330A2}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCDE86B6-C08B-43DB-9FC0-6EBAA7A319ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCDE86B6-C08B-43DB-9FC0-6EBAA7A319ED}\ = "ISinkEvents" regsvr32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1728 wrote to memory of 3456 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 87 PID 1728 wrote to memory of 936 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 88 PID 1728 wrote to memory of 2148 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 89 PID 1728 wrote to memory of 4904 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 90 PID 1728 wrote to memory of 5776 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 91 PID 1728 wrote to memory of 3100 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 92 PID 1728 wrote to memory of 4428 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 93 PID 1728 wrote to memory of 4884 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 94 PID 1728 wrote to memory of 3560 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 95 PID 1728 wrote to memory of 4084 1728 2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_6f4cdf883f93bde7103aaeb81d8d3eae_amadey_darkgate_elex_icedid_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s AddIn4Excel.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3456
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s AddIn4PPT.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:936
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s AddIn4Word.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2148
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s OverlayIcon.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4904
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s OverlayIcon2.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5776
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s AddIn4Excel64.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:3100
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s AddIn4PPT64.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:4428
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s AddIn4Word64.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:4884
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s OverlayIcon64.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:3560
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s OverlayIcon264.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:4084
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\AddIn4Excel.dll
- Size 119KB
- SHA256 c9e86daef89dd4a457208e7d51d971f449b0f7e16b51c771aabdf4a8bc105777
- MD5 3a60c3d2f4cd9e73c7deae2ef1773b0c
- SHA1 ec2ae52be74fa146d3ec6a28c7250f359446cb20
- SHA512 523ba2f75c4ce7c3a94fb8aaa8943b7795f5cec4b889975d3a9f7f196e0aea3bef4df16437a57ccc24c1224d4ba00430e42a7f6aa476df5faf6b904057bda510
- SSDEEP 3072:2o9VnOxH3Ps/8y/sykfjRkxByn5+UclNIf:2o9VnOH/skzk6Cif
- TLSH T146C37B12B695C0B2C08A25390425D35A577FBD32DFA595C73BAC3B6E8F703C15E3A24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\AddIn4PPT.dll
- Size 121KB
- SHA256 662b3093514b5f56e0b8aeccbfd90e821e197594cc99b4e805ee582e3c3bf259
- MD5 7a31f5e6c89e81e52024c92cab464912
- SHA1 cbf800901d9b1f9e2278f11ff39f2fb3a3567db4
- SHA512 681494966b48f7c4e55fc0d201068bd84f13a9c9f5cc8ab091a372bed1f637267a61cc195f4d04de818993ffc6b6d17fc0596ec2a2bc46f1b1bf8b27a0ed4a05
- SSDEEP 1536:40zKK2cJI9BfVn0AmOuThQmT52tdkzkwHAgfCJIS6ryn5XdGpUSTFCe3h2D:40zWcqBn0HOuMwHAgfCJIxryn5X4DEzD
- TLSH T1B7C36B127695C0B2D49A253A0425C3565B7FBD22CFA685C73BAC376E8F703C19E3934A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\AddIn4Word.dll
- Size 118KB
- SHA256 8b64191de1960489db3b4a319bf00927c4922439c349ad9124754ec0d5de806c
- MD5 fde47cfcf3a5c9891138647c6a98984e
- SHA1 e530043b3e1a9702b918026b865905d288cad35f
- SHA512 0324547ef41a305f3ae83f416300e95a5104184ed02e34dbcd03c69354f51e010cca2a310a5b3b66bdc188009082d9d3091973328d374e60ca1ad5876f549c6d
- SSDEEP 3072:8h+c4fAD/dvqWempTwAMkqfmfPRyn5XX7+NDU:S+cqg/975p0AYCZU
- TLSH T151C36B127691C072D09A253D0425E3166B3FBEB1DFA589C77BA8376D8F713C09E39286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\OverlayIcon.dll
- Size 189KB
- SHA256 a03b5734ca6bdf6209b735b5fb7c55ae21386ffcd8f28025159cc336ad93102b
- MD5 c5408b3efff0f2f2c489df59d3bebeb1
- SHA1 9cfe2cca00e8fc1373b56313b5478baf309222f0
- SHA512 3440e5940cb3a6b44f826889dde6940028ea7242a8638de70f2991c698c78084ea2f6b8fe81f062537537a9f5fbc00b9580be8d28c7b548e4a1dd82306e32145
- SSDEEP 3072:pRaQGPoKzyJmpTovOIlqyjj6rdM4CmQTtWHQ5J+G1UonGt:pRaQY4mOvrl6rdMKQqhGpGt
- TLSH T1B4147B503381C072D65B15784826C7B56B7ABD318FA48AC77B993F7E5E303C06E3928A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\OverlayIcon2.dll
- Size 119KB
- SHA256 e58371ecd9adc1810a8ed51bd2cd05772eceabbc0d5f0896cff488b8402a4332
- MD5 ddfbd74ce8e6dadd49078468d8c14b24
- SHA1 81cacb66d754dcdd481571e05fedfe90827ccd95
- SHA512 d955a8a9e169f90606e8d6618840e58b7d08b2ccfc252200f085434523affdd625700fe64234105558f3feebc7b17fe4a67ef979d94c76bac1ae953c6fd487e1
- SSDEEP 1536:8Un+1a13vbCQIMKg0m4j3RjRmtckOO4yT6plf5ryY3+QDBVk43hA4:QoDCFM2msItHOplf5ryE+umH4
- TLSH T128C36B217A51C072C49FA43D0966C3A15B2FBE319FA189C77B68376E5F703C16E3A246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AddIn4Excel64.dll
- Size 134KB
- SHA256 ad729ccb13312c0d9d24c091e60de481b2622f2a026da0810f4b15c97567bdf9
- MD5 8252f3c89928d0fef04040de8b9b0089
- SHA1 3691e91182510381cb44122931259e0e8c8db98d
- SHA512 ac1ef3922a6598c417456a35ae4ee117e994d5e70da00be3fcbf3a003291ce267d067676f83431cbece3819f77282480176a1aebe692b33cd3b5f7d449191909
- SSDEEP 3072:OxEvz8z14R2ns+9CwkOSde8rt74VPHfCMXGyM5iaQ5JrUN:wtz14Ynt9CZdjY4Q5J4N
- TLSH T147D35A4B77A540B7D4668139CA938A49E7B2BC510B6193CF3768A35E6F333D16E39320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AddIn4PPT64.dll
- Size 137KB
- SHA256 6a5e73c4aa0c912ea105bb546cc6d38756bb134115f59270045970ab6128aef8
- MD5 ee86b2f311d251821b008c49e9a482f1
- SHA1 190abf3a2624eb30c5b3d7699e93676fe39651d9
- SHA512 5b6a562eed06a04da5e3d2a288eadac79a29b4f6dc06ff336f452984d13dd3b6afeb8d88ddc914628c98b9afe215c2cda3b7cfe75e8d4312cace64e7a1977e2c
- SSDEEP 3072:bnnNzA/9qVvHHL/Ci8YxBkDf6YipfGkEqzXDyM5HeUGo:TNzA/9qRHr/C4xaD6LEqzERo
- TLSH T1EDD35B87B7A440B7D0678139C9938A85EBB2BC410B6153CF6768A35E1F337D1AD3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AddIn4Word64.dll
- Size 134KB
- SHA256 2551a738fb96aaf5275462bc987ec88157639e928119ab221611fcfc2ebcf283
- MD5 5de4074d507a3efdf67b008b024d5a48
- SHA1 527bde3321519dcd73a7d2b9f020dd4505453a55
- SHA512 a31a569ddd93e4ad0022ea5b5047c33b67ca2bb4363348a56eb84ff7606dc39575cf3b71999acab1bd2654e130f3cc72376616f843e60786d323b33e640329f2
- SSDEEP 3072:6Mqp9H2nkQxY3Zl0qQmw9V/yRmkfMZ6yM5+PHu7:c/H2kQK3ZPQmw9VPTO7
- TLSH T1F2D35A4777A440B7D0668239CD938A45E7B2BC550BA143CF2768A75E2F337D1AE3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OverlayIcon264.dll
- Size 134KB
- SHA256 4c80d7de907d49b435f594eca03e26d741b3bd9b394aadfd50be375485eb1089
- MD5 bd95de16e87cf16b922de78a09196811
- SHA1 3f30b6cd9b55196a4c73758ab4da7512f3b69e23
- SHA512 bfd9f6b171f977d24dce10fd4ca993d968d1fdc7a052bfb5539b1bcfdb43071c74cac94e433d6aa167168379d9a39a82e9738599b9b5c6a8844a7f8b5f99cbc5
- SSDEEP 3072:vT0iZmFhnhlQDaH5eJ/Q5TfCpGmze5CX5SemuZ+PA:zZGhaDaH5V5TfCpTaCxmuZiA
- TLSH T1EAD3395B77A480B7D4269139C8938A89E7B27C160B7547CF6228B39E2F337D15E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OverlayIcon64.dll
- Size 214KB
- SHA256 36b8308f5f038f321f69c6cb0abf180f2fefb02db8521153be20dabe5efd983a
- MD5 558a72b61d93dc59e9d897ef364cb0f6
- SHA1 629a3bf55733ef516782df280daf444a6172e563
- SHA512 c7783c17fac7800ce04d999e69f523d13528d6052fc8842631762ea4fe8cf9f088b43e603bcb0ebf1d06d9d8c5bd516dfc5a1d2e9019b2ff9df4fa120912cc4c
- SSDEEP 3072:h86q8nEr8NrXhcXX/mrLOvOya1dNSMiLmhpGIa3dPgAt7oc5ZJz1YG:h1qAYGrRcXOrLqQkMiihkIa3BoGzWG
- TLSH T152246B46B3A440B6D8278139C9938795F672BC160F6053CB6364B3BE6F377E1693A312
- MD5 SHA1 SHA512 SSDEEP TLSH