42fac523474bb180e1497fee8f3271e5b6ef0bba4fa3d54a85fea000c0390aff

Analysis

max time kernel
12s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.2MB
Sample260723-1g2k8awset
SHA256 42fac523474bb180e1497fee8f3271e5b6ef0bba4fa3d54a85fea000c0390aff
MD5 4b6646c5abbadac0df0b02deeccd2554
SHA1 6bc7990e7a2aeed9174c011f6edd0fd81d728242
SHA512 b610e2df1fb43daee6e632d157769b5f1fc4b5f234db8c58f4cb65608da0d666653ce5d393c7ca9366de8dee577b68bd6b9a9ba0088869e30d1bdb49905978b0
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+K:bLNLNLkqCdHq+V8tgJd8tVst
TLSH
T1D9558D52F3D144FAE0A205318D6592313379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 30 IoCs

resource	yara_rule
behavioral2/memory/1812-0-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/files/0x000400000001b888-214.dat	UPX
behavioral2/memory/1812-860-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/3404-872-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/2132-1300-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/2352-1308-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/6072-1732-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/2240-1737-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/1828-1960-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/1952-1965-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/5148-2391-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/4172-2457-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/1476-2613-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/4112-2656-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/6060-3124-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/416-3446-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/4500-3470-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/1284-4001-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/4280-4003-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/files/0x000d00000001c46e-4078.dat	UPX
behavioral2/files/0x00150000000189a1-4069.dat	UPX
behavioral2/files/0x0003000000019911-4046.dat	UPX
behavioral2/files/0x000300000001991e-4152.dat	UPX
behavioral2/files/0x0003000000019920-4151.dat	UPX
behavioral2/files/0x000300000001991f-4184.dat	UPX
behavioral2/memory/4748-4560-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/692-4954-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/4948-5270-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/2776-5742-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/5776-5795-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
3404	spfirewall.exe
2132	543.#.exe
2352	801.#.exe
6072	740.#.exe
2240	301.#.exe
1828	341.#.exe
1952	357.#.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	341.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	spfirewall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	543.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	801.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	740.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	341.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	543.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	801.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	740.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	301.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	301.#.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 22 IoCs

execution

Visual Basic

T1059.005

pid	Process
2952	wscript.exe
5848	wscript.exe
5728	wscript.exe
4768	wscript.exe
5456	wscript.exe
4092	wscript.exe
3256	wscript.exe
3660	wscript.exe
2168	wscript.exe
3880	wscript.exe
4920	wscript.exe
3660	wscript.exe
1928	wscript.exe
5480	wscript.exe
4924	wscript.exe
5988	wscript.exe
1764	wscript.exe
5476	wscript.exe
5672	wscript.exe
3736	wscript.exe
6096	wscript.exe
3788	wscript.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1812-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000400000001b888-214.dat	upx
behavioral2/memory/1812-860-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3404-872-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2132-1300-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2352-1308-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/6072-1732-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2240-1737-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1828-1960-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1952-1965-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/5148-2391-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4172-2457-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1476-2613-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4112-2656-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/6060-3124-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/416-3446-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4500-3470-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1284-4001-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4280-4003-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000d00000001c46e-4078.dat	upx
behavioral2/files/0x00150000000189a1-4069.dat	upx
behavioral2/files/0x0003000000019911-4046.dat	upx
behavioral2/files/0x000300000001991e-4152.dat	upx
behavioral2/files/0x0003000000019920-4151.dat	upx
behavioral2/files/0x000300000001991f-4184.dat	upx
behavioral2/memory/4748-4560-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/692-4954-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4948-5270-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2776-5742-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/5776-5795-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.log	301.#.exe
File opened for modification	C:\Windows\:\systemlog.log	spfirewall.exe
File opened for modification	C:\Windows\:\systemlog.log	801.#.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spfirewall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	740.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	543.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	801.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	357.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	341.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	301.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JSFILE\SCRIPTHOSTENCODE	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\HTMLFILE\SCRIPTHOSTENCODE	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\ = "Script Encoder Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ASPFILE\SCRIPTHOSTENCODE	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary\ = "Scripting.Dictionary"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asa	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ProgID	regsvr32.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	740.#.exe
File opened for modification	C:\Windows\:\systemlog.log	301.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	341.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\:\systemlog.log	spfirewall.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	543.#.exe
File opened for modification	C:\Windows\:\systemlog.log	801.#.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1812	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
3404	spfirewall.exe
2132	543.#.exe
2352	801.#.exe
6072	740.#.exe
2240	301.#.exe
1828	341.#.exe
1952	357.#.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5308	1812	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 3404 wrote to memory of 4148	3404	spfirewall.exe	94
PID 1812 wrote to memory of 5988	1812	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe	95
PID 3404 wrote to memory of 2952	3404	spfirewall.exe	96
PID 1812 wrote to memory of 2132	1812	2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe	97
PID 2132 wrote to memory of 4464	2132	543.#.exe	98
PID 3404 wrote to memory of 2352	3404	spfirewall.exe	99
PID 2352 wrote to memory of 4692	2352	801.#.exe	100
PID 2132 wrote to memory of 3660	2132	543.#.exe	126
PID 2352 wrote to memory of 2168	2352	801.#.exe	102
PID 2132 wrote to memory of 6072	2132	543.#.exe	103
PID 6072 wrote to memory of 1304	6072	740.#.exe	104
PID 2352 wrote to memory of 2240	2352	801.#.exe	105
PID 2240 wrote to memory of 5408	2240	301.#.exe	106
PID 6072 wrote to memory of 1764	6072	740.#.exe	107
PID 2240 wrote to memory of 3880	2240	301.#.exe	108
PID 6072 wrote to memory of 1828	6072	740.#.exe	109
PID 2240 wrote to memory of 1952	2240	301.#.exe	110
PID 1828 wrote to memory of 4404	1828	341.#.exe	111
PID 1952 wrote to memory of 4916	1952	357.#.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4b6646c5abbadac0df0b02deeccd2554_coinminer_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5308
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\910030.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5988
- C:\Users\Admin\AppData\Local\Temp\543.#.exe
  C:\Users\Admin\AppData\Local\Temp\543.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4464
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\667888.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\740.#.exe
    C:\Users\Admin\AppData\Local\Temp\740.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1304
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\525280.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\341.#.exe
      C:\Users\Admin\AppData\Local\Temp\341.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4404
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\391460.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\512.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\512.#.exe
        5⤵
        
        PID:1476
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:3188
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\413952.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\518.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\518.#.exe
        6⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\557949.vbs"
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4768

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s scrrun.dll
1⤵
- Modifies registry class
PID:1804

C:\10a0699fa37928d39c\spfirewall.exe
C:\10a0699fa37928d39c\spfirewall.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4148
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\774944.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\10a0699fa37928d39c\801.#.exe
  C:\10a0699fa37928d39c\801.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4692
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\55172.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\10a0699fa37928d39c\301.#.exe
    C:\10a0699fa37928d39c\301.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5408
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\845653.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3880
  - - C:\10a0699fa37928d39c\357.#.exe
      C:\10a0699fa37928d39c\357.#.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4916
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\245922.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5848
    - - C:\10a0699fa37928d39c\207.#.exe
        
        C:\10a0699fa37928d39c\207.#.exe
        5⤵
        
        PID:5148
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:4424
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\19542.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:6096
      - C:\10a0699fa37928d39c\512.#.exe
        
        C:\10a0699fa37928d39c\512.#.exe
        6⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\102367.vbs"
        7⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4920
        
        C:\10a0699fa37928d39c\469.#.exe
        
        C:\10a0699fa37928d39c\469.#.exe
        7⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\319881.vbs"
        8⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3660
        
        C:\10a0699fa37928d39c\433.#.exe
        
        C:\10a0699fa37928d39c\433.#.exe
        8⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\153759.vbs"
        9⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1928
        
        C:\10a0699fa37928d39c\996.#.exe
        
        C:\10a0699fa37928d39c\996.#.exe
        9⤵
        
        PID:416
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\15346.vbs"
        10⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5672
        
        C:\10a0699fa37928d39c\955.#.exe
        
        C:\10a0699fa37928d39c\955.#.exe
        10⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\46825.vbs"
        11⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5728
        
        C:\10a0699fa37928d39c\337.#.exe
        
        C:\10a0699fa37928d39c\337.#.exe
        11⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        12⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\899944.vbs"
        12⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5480
        
        C:\10a0699fa37928d39c\737.#.exe
        
        C:\10a0699fa37928d39c\737.#.exe
        12⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        13⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\442028.vbs"
        13⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4924
        
        C:\10a0699fa37928d39c\323.#.exe
        
        C:\10a0699fa37928d39c\323.#.exe
        13⤵
        
        PID:692
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        14⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\839687.vbs"
        14⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3736
        
        C:\10a0699fa37928d39c\415.#.exe
        
        C:\10a0699fa37928d39c\415.#.exe
        14⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        15⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\913646.vbs"
        15⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5456
        
        C:\10a0699fa37928d39c\584.#.exe
        
        C:\10a0699fa37928d39c\584.#.exe
        15⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        16⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\332210.vbs"
        16⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4092
        
        C:\10a0699fa37928d39c\713.#.exe
        
        C:\10a0699fa37928d39c\713.#.exe
        16⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        17⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\736675.vbs"
        17⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3256
        
        C:\10a0699fa37928d39c\417.#.exe
        
        C:\10a0699fa37928d39c\417.#.exe
        17⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        18⤵
        
        PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spfirewall.exe

Path C:\10a0699fa37928d39c\spfirewall.exe
Size 1.2MB
SHA256 42fac523474bb180e1497fee8f3271e5b6ef0bba4fa3d54a85fea000c0390aff
MD5 4b6646c5abbadac0df0b02deeccd2554
SHA1 6bc7990e7a2aeed9174c011f6edd0fd81d728242
SHA512 b610e2df1fb43daee6e632d157769b5f1fc4b5f234db8c58f4cb65608da0d666653ce5d393c7ca9366de8dee577b68bd6b9a9ba0088869e30d1bdb49905978b0
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+K:bLNLNLkqCdHq+V8tgJd8tVst
TLSH
T1D9558D52F3D144FAE0A205318D6592313379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 f02da2165a1a4565bef8d31728bee7c2621309d7d7835cc483588bd7153c17a8
MD5 c045df72d0cb24b459d1cc9a50b41842
SHA1 8de13b66ac2e85d6ca69f03d8ce6eba7ecc45396
SHA512 8d0f036b458c2d1dcbfdabeec1f2c4b5e0116a37b7a1733971479ef81bcb9d37031ed8a08df62ba13e7ab26af8dad9931f8dba2a488410a00b3ff39d5ef8db8c
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+UF:bLNLNLkqCdHq+V8tgJd8tVsl
TLSH
T1C0559D42F3D144FAE0A205318D6592317379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 f194225753c0b73abaf547085e4f8b76d0628c03a6837a72e0466965d524c996
MD5 ad75c7a71fcf24e5567c2afbf713fe25
SHA1 2ea3c496acf13fa596553fe2b46efe199608d11d
SHA512 3d5f11eda8d654b9e981266b8676ac545ffe671c30bf0c1b10d19d4b0799097e11e465147660c1f17f68b376f0de3de9c33abce77e3d4e3348a4b421511a92f1
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+Sw:bLNLNLkqCdHq+V8tgJd8tVs0
TLSH
T10A559D42F3D144FAE0A205318D6592317379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 f5b178ee94201ac8bd045ce681378e01ef8647eb6bf3b63d78e0bc80b023efa7
MD5 f48d5e67670e053cf523666ef697661d
SHA1 cde90142157eaf982e6e8790d6c077ea05bdc757
SHA512 ef481416eae36971aafade0921e32463c8667edc69b722300dc00bb59c90ffcd407e063a545dbd7d0633606f7393678f6fe9d21844268041f965588a62bab361
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+ZT:bLNLNLkqCdHq+V8tgJd8tVsc
TLSH
T1FC559D52F3D144FAE0A205318D6592313379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 1.3MB
SHA256 7f3d1d527ee28a6ac77280e07c33005cac5cc8b76813a5411a58a995cbd9032d
MD5 3a037e5d91eb199f037e9073856e4254
SHA1 903ca94848c2bdde5d2d63543f1ad633e7cbebf9
SHA512 168a43490571934eac1cc1fc466baf2643b114e9583667dfa7cd4e8afe3adcbbaf1608dddf79839c64c11e177d4407770e468ee9f481db66d546eda1b3aeb747
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+du:bLNLNLkqCdHq+V8tgJd8tVsV
TLSH
T1A4559D42F3D144FAE0A205318D6592317379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe$

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe$
Size 1.3MB
SHA256 96c5d634c02aa4a98fdd3498607849846ee12b2ee4ede23b8d03e3462723d437
MD5 06003331791bcf1a04b3ac3b46565c82
SHA1 aed42f8ee6b92ba20811df284739ed325a7980bc
SHA512 1d77d99b37ef94275e5bcf15b85c8da3a1d1dc9b9886a12fa4b80c4c03023ba2010917ee689c4f186dd7a1597d0d75493166ecf6d04f30a3fc32e87896f9b7e7
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+e4:bLNLNLkqCdHq+V8tgJd8tVsk
TLSH
T179559D42F3D144FAE0A205318D6592313379BDE15D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe$

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$
Size 1.3MB
SHA256 3ea9871c7c9bd0f26e5b51ecc06ee8813d6e0a68bd6d8c6937bd14fe2c55ab97
MD5 3ed430d936693ef0a8c4457151643185
SHA1 ae4d561019c74e3fd0c456ec5c8e1026069c1126
SHA512 7efce3c171eacef3ddaa892caba91cadf0761564aca95320fbb7c8862250e48fe705a23b98b1c5b89c62229e6d14c9e107e39da3c7c0873049aa6d881d3c8424
SSDEEP 24576:KZZJkLAZZJkLAZZJkLQdqmTQ96H0N+V8tgJd8tFHDUT+Qo:bLNLNLkqCdHq+V8tgJd8tVsS
TLSH
T159559D42F3D144FAE0A205318D6592317379BDE11D3A864B7340FE6A3E71BE39A3635A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

102367.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\102367.vbs
Size 3KB
SHA256 1121d9e3645b2c8c4e6b8f23227e070680c4e7a617e57a8ec37ba1bbbb051cbc
MD5 3ea27a694304e5d5328f6e1993d49912
SHA1 553cbb1795f5125385b2f94ae46ed825d858f90e
SHA512 aeabbcf99c5364b93e8d4a9ce7f58670a44ab35dcb01e8515bdf56768c8215fe81ec8e824c40db6aa30cb32299b81d7250a8c9b5a048438e259e6d460699a1e8
TLSH
T1C3815539EC2E817A8307A2E60BF344CCFB4EEC4920A6F01C4611F98DA2F4170471A5ED
MD5 SHA1 SHA512 TLSH

Submit Download

413952.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\413952.vbs
Size 3KB
SHA256 da6259dabab9a4cfda4ec3c87539d502320fc0b04b93596d4df555bc0a99deee
MD5 c255556442d2ca2ceae9ce56d356ece8
SHA1 1fad833f6cab40150ee2a52316dda9f7d2206f2c
SHA512 addd76a1d892ef2ad960e6e095e0151e5d507a4b5199d0d8f94ff1aa7aac621cf8b97964951458ff4348443984c13dfb77c56583ba7250a372fbeb8f4ff75b56
TLSH
T1C1616539EC2E817A8307A2E60BF344CCF74EEC4920A5F01C4611F98DA2F4570471A5E9
MD5 SHA1 SHA512 TLSH

Submit Download

525280.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\525280.vbs
Size 3KB
SHA256 3c53f04a17e1441abf856a4cf4fdf12932547429553dad21b60f0b29536b28b2
MD5 9d42a2a88806d8e8c52618f14a37c301
SHA1 fd385e68ade7d1b024eab8a105c020faf000ef85
SHA512 508aa1ec5e56c7ad712948710e5d8abb5cc48ab1bd9f94d09e9351cd59b4b6f865d4d6c325b5ffa53fa192d0c001e30b7d32421a49c87f7603cb8e9aef32fdaa
TLSH
T1C6716539EC2E817A8307A2E60BF344CCFB4EEC4924A5F01C4612F98DA2F45704B1A5E9
MD5 SHA1 SHA512 TLSH

Submit Download

910030.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\910030.vbs
Size 1KB
SHA256 d334f814191c87d40c8a2a23980a6f3c10b45f613300111f378bf90855c53e7d
MD5 f21ce4df0c73d56e121025e9a452ae70
SHA1 95062f77f52e3f23689f127f4df24a8a009d699c
SHA512 2009c0dba73543e992a9aa406f09efc030eee9d82eeec79c5f76f4385bd8db4ad77746758e901f3b2f77a76f0e97f70426a2712717f923b9bcf195e8ae4ac3ff
TLSH
T1F13153399C2E817A4317A2E60BE740CCFB4EEC4A20B5F01C4655F98DA2F45704B1A5EA
MD5 SHA1 SHA512 TLSH

Submit Download

910030.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\910030.vbs
Size 7KB
SHA256 1b8b156045f2d2c6f4da7fc2954664a94911cfaf3dc84112ad2ce7607d34bbe0
MD5 33335dd94c649c3e71ebd95eed947b4e
SHA1 07e236e84d2b8cc42bf622945172a49b3d29e64b
SHA512 9512f7696a742a153f8ae4275b6e73b5ed657ba8e0252ba408188727cdc602905c301b67a1c426143bad1e44da3957b2a8c703202f9413e9fc91d2dff7c7dc3b
SSDEEP 192:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVBlMcfWJVFsPXnMqqDvGs1OPqYcp:TyR/
TLSH
T137F14339EC2EC57A8307A2E60BE744DCE74EEC5924A5F01C0612F98DA2F16714B1A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

910030.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\910030.vbs
Size 19KB
SHA256 68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a
MD5 e98740f59246b23b0d7f73f141f24d47
SHA1 1bfd55b3f13c85f94e1694bffa89a2d79a61a630
SHA512 d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928
SSDEEP 192:InKAhFw4rJWAm+CQBD4kTj4CPYb1k9RiO7TKVBlMcfWJVFsPXnMqqDvGs1OPqYc4:TyRi2mpCC
TLSH
T17E925435EC2E817A8317A2E60BF740DCFB8EEC5924A5F01C0652F98DA2F1671471A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-3446-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/692-4954-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1284-4001-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1476-2613-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1812-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1812-860-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1828-1960-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1952-1965-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2132-1300-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2240-1737-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2352-1308-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2776-5742-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3404-872-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4112-2656-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4172-2457-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4280-4003-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4500-3470-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4748-4560-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4948-5270-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5148-2391-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5776-5795-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/6060-3124-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/6072-1732-0x0000000000400000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads