gh0strat | 746ca2877002962bc5f1592368f503fbcc6cba0651d66e47fe0a21d0945c974a

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Size 7.3MB
Sample260716-e4gnnsc13k
SHA256 746ca2877002962bc5f1592368f503fbcc6cba0651d66e47fe0a21d0945c974a
MD5 56f3de03811116a8ed4dab0e96d889ca
SHA1 f078f324cb3c5544c50695ea6db8880972b9e675
SHA512 bd1c7859dbca7acfba8b6ffbabf4312bb6b646e423f16e775404621108320f18bc5c4c217dccf75ce1948a8865effb7006bce07207dee2fc63bf1a8a405517ee
SSDEEP 98304:0ws2ANnKXOaeOgmhSvP04nsmtk2aXHfzBMyXkx4FL8VdL0hvADfHraUkBqhJonrI:iKXbeO7+TLCzqye4yVdDfLawks
TLSH
T17F76E003B6914432C39225B1DE66D6B25B257E7D0BF2076776B87ECC3B34682FD2121A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor bootkit discovery gh0strat purplefox xred persistence rat rootkit trojan upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3328-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3328-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3328-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1784-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1784-22-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1784-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1784-33-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3740-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3740-42-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3740-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c34c-6.dat	family_gh0strat
behavioral2/memory/3328-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3328-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3328-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1784-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1784-22-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1784-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1784-33-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3740-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3740-42-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3740-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/3328-15-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/3328-16-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/3328-18-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/3328-17-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1784-20-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1784-23-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1784-22-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1784-24-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/1784-33-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/3740-34-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/3740-42-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral2/memory/3740-37-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 8 IoCs

pid	Process
2816	R.exe
3328	N.exe
1784	TXPlatfor.exe
3740	TXPlatfor.exe
4636	HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1972	Synaptics.exe
556	Synaptics.exe

Loads dropped DLL 3 IoCs

pid	Process
2816	R.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
File opened for modification	\??\PHYSICALDRIVE0	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240733187.txt	R.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3328-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3328-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3328-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3328-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1784-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1784-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1784-22-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1784-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1784-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3740-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3740-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3740-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\360Safe\{C08E01B8-4C46-409f-8466-93FE7B22F216}.tf	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	2816	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5388	cmd.exe
248	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
248	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3752	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3740	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3328	N.exe
Token: SeLoadDriverPrivilege	3740	TXPlatfor.exe
Token: SeManageVolumePrivilege	1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Token: 33	3740	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3740	TXPlatfor.exe
Token: 33	3740	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3740	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
3752	EXCEL.EXE
3752	EXCEL.EXE
1892	._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
3752	EXCEL.EXE
3752	EXCEL.EXE
3752	EXCEL.EXE
3752	EXCEL.EXE
3752	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2816	3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe	87
PID 3932 wrote to memory of 3328	3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe	91
PID 3328 wrote to memory of 5388	3328	N.exe	93
PID 1784 wrote to memory of 3740	1784	TXPlatfor.exe	94
PID 3932 wrote to memory of 4636	3932	2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe	95
PID 5388 wrote to memory of 248	5388	cmd.exe	98
PID 4636 wrote to memory of 1892	4636	HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe	99
PID 4636 wrote to memory of 1972	4636	HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 508
    3⤵
    - Program crash
    PID:4412
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:248
- C:\Users\Admin\AppData\Local\Temp\HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
  C:\Users\Admin\AppData\Local\Temp\HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Temp\._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1892
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2816 -ip 2816
1⤵
PID:4612

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3740

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3752

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 4aa035a61476710eab31f09cdfa6c23d24fe6b8eb36cd7a71db05b0fe3b1202a
MD5 589e0853896f9b8a51bad44fd736043e
SHA1 3b33c5f593bacae9c790e2ba9ce011aec9cb7b96
SHA512 177074ae79e177de28dba04c255499e496a054ffc794af8270d11e04f5f1ef73d000f90dbcb531430bc384a315aaf0c278b2aa91cfd016b011ef0e6a88cb044c
SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IOr:ansJ39LyjbJkQFMhmC+6GD9p
TLSH
T1EFF47D32F2D19437D1721A3D9C5BA3A5582ABE512E38794E3BF81E4C5F3E68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 3KB
SHA256 0517b203a1b972dddaee9193c391b2667aa06371152b4443abc8da7490ba93f3
MD5 d5808185114915512502c8f32f0f8082
SHA1 722200b3216f3185aec5b960f879c668f5f81e3b
SHA512 c68ef96a41946acb53e68fb95e2ef9680eae7572223f9c59a9ab0c5cb0227b76a8bac45a462bf51fda597bc5178ff9ceb3f6e8ffd901bc1800caead6414a33fe
TLSH
T1AA716F5E429E6504FEF9E270449C17B6971E0171864E0B4571CC74DF857B4F99CB1770
MD5 SHA1 SHA512 TLSH

Submit Download

computer_rescue_icon.png

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\computer_rescue_icon.png
Size 838B
SHA256 e4b839057fcf4fa07d8e84e1a83f1096cf36c89a2f19f692d4ffbfd0706c62b4
MD5 3090d2de85382dff85b62ba401ad154a
SHA1 ef99c36242f2b16b8f5c124bf045d435cec0858e
SHA512 05d16c277259fdcfada9aa2bfdb88de1356e7b1384ea24686821af3bf3c127d4ed2c1f26aeb4b87d23747fa4ea6e46f95756c980bf7501221384495219149665
TLSH
T1D70186E2E150E79C889F36075B0F65915DA214C2A143694F3DFFE995490B4CACBE0B94
MD5 SHA1 SHA512 TLSH

Submit Download

custom_wnd.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\custom_wnd.ini
Size 2KB
SHA256 045219484debeafdcedb04e6fd0c914cb4db13a712b2abdad75b33696f28f7ac
MD5 9b112c4f740a4e1454b5c799f858727d
SHA1 40349402d12d0de24332a99baf007054f6d46b1d
SHA512 5d2c68cd2fe2444100a1a3031d33b1f6c186384af40c943d711e5b39a29bf9592e59e45d5b35fab59415db86b5abd926ee58aadd857a3868672ff3e648a63907
TLSH
T1A241769726F99006F9B78B62EA7118B16B32BD52AC1CC50C69D0954D84EBD85C5333F3
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Size 1KB
SHA256 69ced659e6592a75206e47dad54cc510bc5141198ec07001ae96500d195bffc3
MD5 6d5970c8d1f66e41d3c7db871013b183
SHA1 345ade553519680b16bb410a32e2c2604a616398
SHA512 cd0f4a0045c5f7ca20b79b36f617c734c349ba29c9547f6f1fe4445502990a331b09f3bbfdfef378072212eeb210e9c2b1cffadc21f8b7822559561768f5dcf3
TLSH
T1EC21740C9A40C7E2A55A047B6317B3A87FFF1727C0C5B15CB4511C4CBF3889BA6446C2
MD5 SHA1 SHA512 TLSH

Submit Download

soft_manager_icon.png

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\soft_manager_icon.png
Size 646B
SHA256 4c2639778afba2c0d782996ea8a80152ed25ac2a954f3d525960583bddd12090
MD5 8f7051f0e9b7b4ce87f82dc64fc57972
SHA1 77b7122ee16b8d7141323e5b66b7a2f390265bcd
SHA512 6ebf53ed208c4d6840678074f23fec27735939a948f277f8bf6d2cd6888a13ec6086147d417daf5eab7c3887e2ca4dc64a23579e93238f186faec2d46f8a2501
TLSH
T17AF09ED1D429FAD9DC0F22174A140916BD9205C6158A5B5B8E95D026283FECD5664F44
MD5 SHA1 SHA512 TLSH

Submit Download

._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Size 3.9MB
SHA256 df4478c946bdcb5183401faf293ae6e73f01639bb68e211efaa2876b0863b394
MD5 e4e342f86c4fea405f3e856a4b10784a
SHA1 e0d8ce047347424d17a7c01f17149b37648aae7a
SHA512 d1f853fc60d031b3022d3d7d4e7877f8e0eaf33424602c6e04d56af5f7a92de26d313cf69ba44e3343bc08598f307df22938d7d4cab0e97b3c026905901ff0b3
SSDEEP 98304:oHfzBMyXkx4FL8VdL0hvADfHraUkBqhJonrnYV6:kzqye4yVdDfLawk/
TLSH
T1631601113BD1C075C1B31932DB78E65A4EF6AD310B314BCBA6983A6E1F34DC1AA39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8SgDY2Pc.xlsm

Path C:\Users\Admin\AppData\Local\Temp\8SgDY2Pc.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_2026-07-16_56f3de03811116a8ed4dab0e96d889ca_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_wannacry.exe
Size 4.7MB
SHA256 5be61ee696df16ec7ce60e6ea5900b67d1ae31b74e3c1101b40c534e11e02b1f
MD5 534c23e08a5d74bd3c4a0599a8aa0550
SHA1 d7d99d5450aceae425b7a61f6398edfe9659fa3c
SHA512 b9ac9a0b51bba0ad913d2908e50c4ad25ffd0d2e23083a7660db185d2f1217565c9c61e6c6f1174b53c226f3ef1f6f3a4d6fc188f04efefb1a65384763ded1b2
SSDEEP 98304:jnsmtk2aXHfzBMyXkx4FL8VdL0hvADfHraUkBqhJonrnYVF:7LCzqye4yVdDfLawks
TLSH
T1E236F12277C18036C1731A36DE69E3994D6ABE211F305B8B76E83E5D1F38EC16939253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.7MB
SHA256 f78de337b0fd8e9dc3191e1274c8c27301d7fdfc52a08193ceb12c0ff2048dcd
MD5 9cde56614204ae98d4e79f222bf674a9
SHA1 f651e00547744970e5717eba872c45b5e2fbf04a
SHA512 ac79fd7777e16b581c853f7e3e2c30e98f328210d2f81e3ba526681ffda7101dcf8e0406518afe977d560ea5d89a4c61728ef397ac2ff92d9ada87ad8683a2d8
SSDEEP 49152:5CwsbCANnKXferL7Vwe/Gg0P+WhSkW84F0/:0ws2ANnKXOaeOgmhSvP0/
TLSH
T1BDD56B43A5554462C38875F2DE66D9B39B207E7E17F30236B678BEC43A35206FE2221D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360P2SP.dll

Path C:\Users\Admin\AppData\Local\Temp\{963337E8-E01C-4826-8C1D-39A398CD6698}.tmp\360P2SP.dll
Size 688KB
SHA256 0eca2e140f973b2011c633d4d92e512a1f77e1da610cfe0f4538c0b451270016
MD5 d875875eb3282b692ab10e946ea22361
SHA1 34bcef8a8cb0e1db44671892ac3cbd74d3c541a8
SHA512 972466310d3c145141320584b5f3e431c6888bda2ba1036f85e68e534ed6fb97ba04cbd46d8d9c401dc5857100dc1bff1bad82b50514f3e5c582522f22fd2b5c
SSDEEP 12288:1IhyxJ3BYXF6WxYC2aeHACRYlH+ZOAyTjUnIgidGtAd8Rwb33+YnBsLS683wK9T7:ih8WxYCyYlaOYnliItjRwbH+YBsLS68N
TLSH
T133E4AF1337C08035E2BB0675DE699225AAF9BC704A358A9F63D0854D7E74BC3CA35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sites.dll

Path C:\Users\Admin\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll
Size 1.4MB
SHA256 c1eb83993c85e01ee6ae84eb6e05744ff8c3ccc02c41d09c22286e3012ef46fc
MD5 a2ff2c72e739e0cf4c73b623444ca39d
SHA1 ff886e63c894a20f30c136a8264cfa33d41b8331
SHA512 844dab35a1625d5bf1bd814a36fb80d5670d3dfee5cf65ad8be53784b486dcc08898b7577a323c7c7e1e83655f861ea86c5453cfa4c3d55353d329ef3af6320b
SSDEEP 24576:l4LEubC/9euoUCi82BbjSyM5hGfzmzJHXW+U0:UEubUo1i3eymhGfizJHK0
TLSH
T1BC65AE1237D1C57BC17E1371DA1AB3F697FAE2301A35A547A7C84B1C2F30A83D629A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240733187.txt

Path C:\Windows\SysWOW64\240733187.txt
Size 899KB
SHA256 b4b0fd6471fe2be569f257d91983d14852cc54886ee98bb942977674b75aa351
MD5 7feb4e1e739525bdcaf86fdb4eac02a7
SHA1 1cf72762938988396f9ce5491e1c8e494cfaaf26
SHA512 9907f021969240e7d6f20be289e750b117370bdb7eb504aeb652fca3617af32833ed1f45e02e15ed6e943c5d713f9d9b26a0ef4c699c129d6b7c800d1cc21f35
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXu:7wqd87Vu
TLSH
T181152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-171-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1784-33-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1784-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1784-22-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1784-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1784-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1972-304-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1972-287-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1972-322-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/3328-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3328-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3328-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3328-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3740-37-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3740-42-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3740-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3752-197-0x00007FFCFDAE0000-0x00007FFCFDAF0000-memory.dmp

Download

memory/3752-195-0x00007FFCFDAE0000-0x00007FFCFDAF0000-memory.dmp

Download

memory/3752-172-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/3752-175-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/3752-176-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/3752-173-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/3752-174-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/4636-160-0x0000000000400000-0x00000000008B3000-memory.dmp

Download