2ea111774790a22b85c64c7a1754c20a40f0548e824502520247e5db2ddda268

Analysis

max time kernel
164s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emBridge.exe
Size 6.8MB
Sample260723-larecaba75
SHA256 2ea111774790a22b85c64c7a1754c20a40f0548e824502520247e5db2ddda268
MD5 9df27f498bd8661317a8c0f20bbda1aa
SHA1 362c3709f7cf6f0176b24dcc422dc6c8f2255a65
SHA512 00fc8fe173ccd0e2dd32d70e3d8d47dae80898c4a8909ac4ed62472431d77784e6492e4948c1345df30324f521e19cc441d60f5995366ab53a1e5bee89530c4d
SSDEEP 196608:Yp+qe8K0HAz6H2lewx8dcO63rO6tC4XYQ:jR8DgzhlRjK6r1
TLSH
T1C876233FB268663ED9AE0B3245B393509977BAA1781A8C1E47F0084CCF765701E3FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	emBridge.tmp

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\emBridge\ImagePath = "\"C:\\Program Files (x86)\\eMudhra\\emBridge\\emBridge.exe\" -displayname \"emBridge Service\" -servicename \"emBridge\""	emBridge.exe

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x000d00000001c4fc-49.dat	ConfuserEx
behavioral2/memory/2580-63-0x0000000000280000-0x00000000008A0000-memory.dmp	ConfuserEx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\eMudhra\emBridge\is-QEIGL.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-P8OD4.tmp	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\CertEnroll_Interop.dll	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-MIBTB.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-TFAFK.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-9L2PM.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-4Q19Q.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-7Q9QV.tmp	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\23072026.log	emBridge.exe
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\23072026.log	emBridge.exe
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\NLog.dll	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\Pkcs11Interop.dll	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\Topshelf.dll	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-P8FPK.tmp	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\unins000.dat	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\System.Net.Http.Formatting.dll	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-46611.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-83JU9.tmp	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\23072026.log	emBridge.exe
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\httpcfg.exe	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-OIMKU.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-8MUEB.tmp	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-2L8RO.tmp	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\Topshelf.NLog.dll	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\FP	emBridge.exe
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\23072026.log	emBridge.exe
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\Newtonsoft.Json.dll	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\System.Web.Http.dll	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\is-4TDGQ.tmp	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\System.Web.Http.SelfHost.dll	emBridge.tmp
File opened for modification	C:\Program Files (x86)\eMudhra\emBridge\dotNetFx45_Full_setup.exe	emBridge.tmp
File created	C:\Program Files (x86)\eMudhra\emBridge\unins000.dat	emBridge.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\TmpFDCF.tmp	emBridge.exe
File opened for modification	C:\Windows\SystemTemp\TmpFE0E.tmp	emBridge.exe
File opened for modification	C:\Windows\SystemTemp\TmpFE3E.tmp	emBridge.exe
File opened for modification	C:\Windows\SystemTemp\TmpFE3F.tmp	emBridge.exe

Executes dropped EXE 6 IoCs

pid	Process
4972	emBridge.tmp
2580	emBridge.exe
4692	emBridge.exe
3728	emBridge.exe
5104	emBridge.exe
3940	emBridge.exe

Loads dropped DLL 34 IoCs

pid	Process
4692	emBridge.exe
4692	emBridge.exe
2580	emBridge.exe
2580	emBridge.exe
3728	emBridge.exe
3728	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
5104	emBridge.exe
5104	emBridge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 54 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5052	cmd.exe
1884	cmd.exe
252	cmd.exe
4628	cmd.exe
1988	cmd.exe
3444	cmd.exe
4912	cmd.exe
3808	cmd.exe
1948	cmd.exe
1972	cmd.exe
2928	cmd.exe
5328	cmd.exe
1280	cmd.exe
616	cmd.exe
3620	cmd.exe
5116	cmd.exe
3760	cmd.exe
4548	cmd.exe
2416	cmd.exe
2788	cmd.exe
3012	cmd.exe
2412	cmd.exe
4344	cmd.exe
3404	cmd.exe
2276	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\763A5703FEB48C23DFD1D491DCD34C9DB5DDE200\Blob = 030000000100000014000000763a5703feb48c23dfd1d491dcd34c9db5dde2002000000001000000540300003082035030820238a003020102020876eda6f578d92a7c300d06092a864886f70d01010b0500301b3119301706035504030c10654d7564687261204c6f63616c204341301e170d3236303732333030303030305a170d3331303732333030303030305a301b3119301706035504030c10654d7564687261204c6f63616c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a507c75f60b2504de71bed2e847350e3a4bf01907521458486718c1a79961752e5e4007e4a4f59ca77b959d5d56ee82e892bd654dd4749320117c072c7ab48c95be0b05db114637613c11e1b6ff3b5854b25f6c8f66ec8e2adafbf4d4e2b682951a4497e6433f279f5f42cd365b8ab6f553a050d75812efa7f8c30d754c807e101cbf70c129fb575d66aa8e530f2d09c3ca1edd05da6762246a0af919fb7e9e273b7739f744e1ec319f58c21666e6331e801f8afeb94743b5fdf0898100a55473b549170478b95164edcfac34a4d5daf6186b772bbbd25d882b69d09ed72c84e42803190b4acc65386d87f6508d5abb70e4b56df0cbd6097789a1c3825b68c770203010001a38197308194301d0603551d0e04160414d3dfefb73f5d5d292d6f1ecdf340152e806d5d9c300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30520603551d250101ff0448304606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030906082b0601050507030806082b0601050507030606082b06010505070307300d06092a864886f70d01010b0500038201010065016c55196d147ccac6891d324e45de0a59c243c7e3bba20e79c71c87d628972f14dcd5e84b549c5679433f8609357c7dd307b4b1c725d45b3a56cb2342b943beab3d8b97e6ab3fe2f17b2c34b9d47c71f36712ca2f9f323b67249dd3240be7b585c26700b46563a6bfdb81b42d214e4d3e49f00da906bb958c3d58900a228e7b473d9b663ced3b4191240876573d22c7a61cdae87f16da10412098c41600f085843322a775f973dc996498c77055cf6c7f4b5d569643f69a61d824ac96db97d45c9a2d38d670568d84141c033f4ecf798aa593612aa054375a1250b4c30e3976379144d535085996573555c4b25ba406beec0ba21de0927ad38ba732d066f6	emBridge.exe

System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netstat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netstat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4536-1-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/memory/4536-9-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/memory/4536-149-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1856	netstat.exe
4716	netstat.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	emBridge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	emBridge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	emBridge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	emBridge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	emBridge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	emBridge.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\763A5703FEB48C23DFD1D491DCD34C9DB5DDE200	emBridge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\A198D4AE3EAF42CB3154444B05626A53689F0A57	emBridge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\A198D4AE3EAF42CB3154444B05626A53689F0A57\Blob = 030000000100000014000000a198d4ae3eaf42cb3154444b05626a53689f0a570200000001000000dc0000001c0000006c00000018000000200000000000000000000000010000007b00340044003600300032003900390043002d0038004400310044002d0034004600410042002d0042003200380031002d003700360039003100300032003700390038003700330043007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000002000000001000000ad030000308203a930820291a003020102020835c64eea2be6e5f1300d06092a864886f70d01010b0500301b3119301706035504030c10654d7564687261204c6f63616c204341301e170d3236303732333030303030305a170d3331303732323233303030305a3020311e301c06035504030c156c6f63616c686f73742e656d75646872612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a02820101008b9f0671a5d4de944b2effce573ab183647bdb7e1e69a7867433bbca39e7b6c186ca9c0b83de58a6ccf2f2238836a7504ddaef4194edc78235ab5863109311d2f19514aca54d2337f559845760cc5dc6a2d4c223230d44fc420def215e6f293d12eb62ac3db77effa0cc51f985c9bda74da03f9eb4e4fb37841ed01c368abd3718f26c42ac3f6d3f8fc2073252c453f8de29e84dbbe07f3e6978324f3f41fd74f6ca0cb16d7ca157cbfe4aa50094cf63265fa2554f1a8777ca52dec8553c319ceeb0b0be5f493d338911f7c6f9c8442eb4f1b13178a3ed43ce0316d2c493d80e23691a94351837620d0af4b7853b94500826ed106fc618d07db3d4ae7e71eabd0203010001a381eb3081e8304a0603551d23044330418014d3dfefb73f5d5d292d6f1ecdf340152e806d5d9ca11fa41d301b3119301706035504030c10654d7564687261204c6f63616c204341820876eda6f578d92a7c301d0603551d0e04160414e8e054afef57328e98e2458fd1a9045b0ceb7489300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302303b0603551d110434303282156c6f63616c686f73742e656d75646872612e636f6d82197777772e6c6f63616c686f73742e656d75646872612e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010076ed09791e9211a84194c92fadec6fe42a634133e9ad432f2b55d9ada8e879a922a2c48a95fa38a832ccfb9e3ae5d38bf192c1f916ec1402c61e4b03fe9d0905654208632c07a387b0ef21dc211a8f9df53f155089af8e1ca15b688fcadf7e10af7ae2ee0afc583c681fac54de8d2d81780b321fecb7db39d7ba1615895315760131b096d047591a879ce0387456c6eddcfbd792767edf1118ef80407ca33767b806248f0171c3ac645104bff468cde56ec1f7932f4b68770873a69e7692ebf6260e4840e37597b5ab32a8a3aeecbb43cacda5435c829ebf8fa69c9456729574f9df120887d2b4afc6c5a1ab5e50441f7d7b1cda7769c140faa619e8dad829cf	emBridge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\A198D4AE3EAF42CB3154444B05626A53689F0A57\Blob = 140000000100000014000000e8e054afef57328e98e2458fd1a9045b0ceb74890200000001000000dc0000001c0000006c00000018000000200000000000000000000000010000007b00340044003600300032003900390043002d0038004400310044002d0034004600410042002d0042003200380031002d003700360039003100300032003700390038003700330043007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f0076006900640065007200000000000000030000000100000014000000a198d4ae3eaf42cb3154444b05626a53689f0a572000000001000000ad030000308203a930820291a003020102020835c64eea2be6e5f1300d06092a864886f70d01010b0500301b3119301706035504030c10654d7564687261204c6f63616c204341301e170d3236303732333030303030305a170d3331303732323233303030305a3020311e301c06035504030c156c6f63616c686f73742e656d75646872612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a02820101008b9f0671a5d4de944b2effce573ab183647bdb7e1e69a7867433bbca39e7b6c186ca9c0b83de58a6ccf2f2238836a7504ddaef4194edc78235ab5863109311d2f19514aca54d2337f559845760cc5dc6a2d4c223230d44fc420def215e6f293d12eb62ac3db77effa0cc51f985c9bda74da03f9eb4e4fb37841ed01c368abd3718f26c42ac3f6d3f8fc2073252c453f8de29e84dbbe07f3e6978324f3f41fd74f6ca0cb16d7ca157cbfe4aa50094cf63265fa2554f1a8777ca52dec8553c319ceeb0b0be5f493d338911f7c6f9c8442eb4f1b13178a3ed43ce0316d2c493d80e23691a94351837620d0af4b7853b94500826ed106fc618d07db3d4ae7e71eabd0203010001a381eb3081e8304a0603551d23044330418014d3dfefb73f5d5d292d6f1ecdf340152e806d5d9ca11fa41d301b3119301706035504030c10654d7564687261204c6f63616c204341820876eda6f578d92a7c301d0603551d0e04160414e8e054afef57328e98e2458fd1a9045b0ceb7489300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302303b0603551d110434303282156c6f63616c686f73742e656d75646872612e636f6d82197777772e6c6f63616c686f73742e656d75646872612e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010076ed09791e9211a84194c92fadec6fe42a634133e9ad432f2b55d9ada8e879a922a2c48a95fa38a832ccfb9e3ae5d38bf192c1f916ec1402c61e4b03fe9d0905654208632c07a387b0ef21dc211a8f9df53f155089af8e1ca15b688fcadf7e10af7ae2ee0afc583c681fac54de8d2d81780b321fecb7db39d7ba1615895315760131b096d047591a879ce0387456c6eddcfbd792767edf1118ef80407ca33767b806248f0171c3ac645104bff468cde56ec1f7932f4b68770873a69e7692ebf6260e4840e37597b5ab32a8a3aeecbb43cacda5435c829ebf8fa69c9456729574f9df120887d2b4afc6c5a1ab5e50441f7d7b1cda7769c140faa619e8dad829cf	emBridge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys	emBridge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\E8E054AFEF57328E98E2458FD1A9045B0CEB7489	emBridge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\E8E054AFEF57328E98E2458FD1A9045B0CEB7489\Blob = 0200000000000000dc0000001c0000006c00000018000000200000000000000000000000010000007b00340044003600300032003900390043002d0038004400310044002d0034004600410042002d0042003200380031002d003700360039003100300032003700390038003700330043007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f0076006900640065007200000000000000230000000000000014000000e8e054afef57328e98e2458fd1a9045b0ceb7489	emBridge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4972	emBridge.tmp
4972	emBridge.tmp
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
3940	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe
4692	emBridge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	emBridge.exe
Token: SeDebugPrivilege	3940	emBridge.exe
Token: SeDebugPrivilege	5104	emBridge.exe
Token: SeDebugPrivilege	1856	netstat.exe
Token: SeDebugPrivilege	4716	netstat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4972	emBridge.tmp
3940	emBridge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4972	4536	emBridge.exe	89
PID 4972 wrote to memory of 1988	4972	emBridge.tmp	91
PID 4972 wrote to memory of 2580	4972	emBridge.tmp	94
PID 4972 wrote to memory of 3728	4972	emBridge.tmp	97
PID 3940 wrote to memory of 4548	3940	emBridge.exe	102
PID 4548 wrote to memory of 5304	4548	cmd.exe	104
PID 3940 wrote to memory of 5328	3940	emBridge.exe	105
PID 5328 wrote to memory of 1736	5328	cmd.exe	107
PID 3940 wrote to memory of 3444	3940	emBridge.exe	108
PID 3444 wrote to memory of 4860	3444	cmd.exe	110
PID 3940 wrote to memory of 4912	3940	emBridge.exe	111
PID 4912 wrote to memory of 5360	4912	cmd.exe	113
PID 3940 wrote to memory of 2276	3940	emBridge.exe	114
PID 2276 wrote to memory of 3032	2276	cmd.exe	116
PID 3940 wrote to memory of 2416	3940	emBridge.exe	117
PID 2416 wrote to memory of 4368	2416	cmd.exe	119
PID 3940 wrote to memory of 1280	3940	emBridge.exe	120
PID 1280 wrote to memory of 5248	1280	cmd.exe	122
PID 3940 wrote to memory of 2788	3940	emBridge.exe	123
PID 2788 wrote to memory of 2628	2788	cmd.exe	125
PID 4692 wrote to memory of 1856	4692	emBridge.exe	126
PID 4692 wrote to memory of 3012	4692	emBridge.exe	128
PID 3012 wrote to memory of 1420	3012	cmd.exe	130
PID 4692 wrote to memory of 3808	4692	emBridge.exe	131
PID 3808 wrote to memory of 3948	3808	cmd.exe	133
PID 4692 wrote to memory of 616	4692	emBridge.exe	134
PID 616 wrote to memory of 2780	616	cmd.exe	136
PID 4692 wrote to memory of 3760	4692	emBridge.exe	137
PID 5104 wrote to memory of 4716	5104	emBridge.exe	139
PID 3760 wrote to memory of 4216	3760	cmd.exe	141
PID 4692 wrote to memory of 4628	4692	emBridge.exe	142
PID 4628 wrote to memory of 3504	4628	cmd.exe	144
PID 4692 wrote to memory of 2412	4692	emBridge.exe	145
PID 5104 wrote to memory of 5052	5104	emBridge.exe	147
PID 2412 wrote to memory of 2628	2412	cmd.exe	149
PID 5052 wrote to memory of 5336	5052	cmd.exe	150
PID 5104 wrote to memory of 1884	5104	emBridge.exe	151
PID 1884 wrote to memory of 2864	1884	cmd.exe	153
PID 4692 wrote to memory of 1948	4692	emBridge.exe	154
PID 1948 wrote to memory of 1608	1948	cmd.exe	156
PID 5104 wrote to memory of 252	5104	emBridge.exe	157
PID 252 wrote to memory of 4764	252	cmd.exe	159
PID 4692 wrote to memory of 3620	4692	emBridge.exe	160
PID 3620 wrote to memory of 544	3620	cmd.exe	162
PID 5104 wrote to memory of 1972	5104	emBridge.exe	163
PID 1972 wrote to memory of 2660	1972	cmd.exe	165
PID 5104 wrote to memory of 2928	5104	emBridge.exe	166
PID 2928 wrote to memory of 6064	2928	cmd.exe	168
PID 5104 wrote to memory of 5116	5104	emBridge.exe	169
PID 5116 wrote to memory of 4392	5116	cmd.exe	171
PID 5104 wrote to memory of 4344	5104	emBridge.exe	172
PID 4344 wrote to memory of 5288	4344	cmd.exe	174
PID 5104 wrote to memory of 3404	5104	emBridge.exe	175
PID 3404 wrote to memory of 3912	3404	cmd.exe	177

C:\Users\Admin\AppData\Local\Temp\emBridge.exe
"C:\Users\Admin\AppData\Local\Temp\emBridge.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\is-FN727.tmp\emBridge.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FN727.tmp\emBridge.tmp" /SL5="$3017C,6335045,781312,C:\Users\Admin\AppData\Local\Temp\emBridge.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\eMudhra\emBridge\proxyexception.bat" ;127.0.0.1 "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1988
- - C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe
    "C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe" install
    3⤵
    - Sets service image path in registry
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe
    "C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe" start
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3728

C:\PROGRA~2\eMudhra\emBridge\emBridge.exe
C:\PROGRA~2\eMudhra\emBridge\emBridge.exe
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\netstat.exe
  "netstat.exe" -a -n -o
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26769/ user=Everyone
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add urlacl url=https://+:26769/ user=Everyone
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26769
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\netsh.exe
    netsh http dele sslcert ipport=0.0.0.0:26769
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26769 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add sslcert ipport=0.0.0.0:26769 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26770/ user=Everyone
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add urlacl url=https://+:26770/ user=Everyone
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26770
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\netsh.exe
    netsh http dele sslcert ipport=0.0.0.0:26770
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544

C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe
"C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\netstat.exe
  "netstat.exe" -a -n -o
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26769/ user=Everyone
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add urlacl url=https://+:26769/ user=Everyone
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26769
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\netsh.exe
    netsh http dele sslcert ipport=0.0.0.0:26769
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26769 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add sslcert ipport=0.0.0.0:26769 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26770/ user=Everyone
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add urlacl url=https://+:26770/ user=Everyone
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26770
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\netsh.exe
    netsh http dele sslcert ipport=0.0.0.0:26770
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912

C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe
"C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe" -displayname "emBridge Service" -servicename "emBridge"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26769/ user=Everyone
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add urlacl url=https://+:26769/ user=Everyone
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26769
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\SysWOW64\netsh.exe
    netsh http dele sslcert ipport=0.0.0.0:26769
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26769 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add sslcert ipport=0.0.0.0:26769 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26770/ user=Everyone
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add urlacl url=https://+:26770/ user=Everyone
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26770
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\netsh.exe
    netsh http dele sslcert ipport=0.0.0.0:26770
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\netsh.exe
    netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="a198d4ae3eaf42cb3154444b05626a53689f0a57"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 1KB
SHA256 8d504ba38ab2a5a732d1fd71818a85361b700feb79cc82e8e03d5f3c81fb1c38
MD5 4565dd277d831319deb5e8bcfb3a9374
SHA1 0112c644b30dbe5e0f5d1948e303af263d188af4
SHA512 238f68c33bfa919fe8462828bbd1239b913cd765c15f87f9b11ebec693ef8405457b642639440395b7fcbc6f20d0d7b1bae5b3e6ee9bedd356593ca93b71d077
TLSH
T163412E984DC4FCF819FBE981329D0B556F8C71BB151E02BDB784868BAE4981831EDB70
MD5 SHA1 SHA512 TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 5KB
SHA256 45a0529ce3a6d4ce99f2045c8d50905f9e2b0a8262cb0c67f0ca6579deb0fbbd
MD5 e30523ce25c6383d57c83c76be4ddbd6
SHA1 759fefe75a6bba4e4e42b19a93ccc64f8ba586d4
SHA512 6da4ca9bf0e3342306992e4f0ab7146d593a4397f13869f0e807bbb9296991f77b22d55ac11ba4d45cc3f5099e5df3a23d47c67a3549b1cec90225a4f19ad171
SSDEEP 48:3JDo0+JKGI8/rHiA9C86SeSbXdVsyDAdav8Z2Lo0asuR4bSVMogyI+3li3li3lic:3JDr+JKG9rHD6SeSbtqyGjt
TLSH
T137B1C79C0DC4FCE859FBE98131984F556F8C21BB161E12F8B744C68BAE9985831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 6KB
SHA256 40297d9a0c11250c3212b7b1776f67568287f0960b8314de0492d56995600cb8
MD5 64c0828b818e9eb2a5c17068fb2058ac
SHA1 ef043b284250b1bfaad6ae90801f5d9a0b497bff
SHA512 cdd7ec9aedf64970ca9b62f76632a39b8477b75f64356ba1e79a445f35c42b7e6389d1f56d9f63571084ba24480d126d319575373567049ea49a4029bdbab394
SSDEEP 48:3JDo0+JKGI8/rHiA9C86SeSbXdVsyDAdav8Z2Lo0asuR4bSVMogyI+3li3li3lif:3JDr+JKG9rHD6SeSbtqyGjBEpb
TLSH
T156D1C79C4DC4FCE859FBE98132984F556F8C65BB161E01F8B740C28BAE9985831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 9KB
SHA256 54ba83c25110bdd67fe9fdcc54ec35802d56e328e837500f97b7266bfd95e0f0
MD5 d2e0a065d163c559206eb78f182c54b8
SHA1 d4790510a18ac2df9aeff78925d4d3434e8311c8
SHA512 cd98aadfa9f96874d70bee34e5351d8a8f022cfd4ec5870cb79b921239cd037a89fbd54aa6031af94005a4f436aae931949369c0a71917048732f58f37e3ae21
SSDEEP 48:3JDo0+JKGI8/rHiA9C86SeSbXdVsyDAdav8Z2Lo0asuR4bSVMogyI+3li3li3lic:3JDr+JKG9rHD6SeSbtqyGjBEpdSMs
TLSH
T12312A69C4DC4FCE859FFE98132984F556F8C25BB161E02F8B640C28BAE9944831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 9KB
SHA256 0732113884ad1c61beed28ccb55ad73d163da32dc5159092bb31a32d9890a3cd
MD5 81e0a11842ff5d7f775845aa3f0941f8
SHA1 78d2fb8ddbe5f5fc0e6f9acea0e77d5e1c63421f
SHA512 9b54f255ef986ababe10e1f56cc7239744bd08364b38b8e799f3a2168163b636c1a569d99e0de401cfc9ac09d2ca84062b94d52daa8e23ccf72f72e058c6bdfb
SSDEEP 48:3JDo0+JKGI8/rHiA9C86SeSbXdVsyDAdav8Z2Lo0asuR4bSVMogyI+3li3li3liF:3JDr+JKG9rHD6SeSbtqyGjBEpdSMV
TLSH
T18212969C4DC4FCE859FFE98132984F556F8C25BB161E12F8B640C28BAE9944831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 10KB
SHA256 0c8a5d1c60ff179ed25bd2422af138aa771656df6cdb8ddb49f7c4d86cf97aae
MD5 8a3e332c00c31f1b0564cd6f06ff75a7
SHA1 834255abf0709337ce50ad86cf75178b174d33a4
SHA512 4f50fa8a18085a38eadc47e30744cbc4e3a51b281fef63edc75c881b84df29e28bdd7e34f8c4b1e57816d61a0b923ad238e78158445706603be4e82117236b1a
SSDEEP 96:3JDr+JKG9rHD6SeSbtqyGjBEpdSMhEMSbg:5SKG9rHD6SeSkyGNEpdSIEMSU
TLSH
T1FD22A79C4DC4FCE859FFE98132984F556F8C26BB561E11F8B640C28BAE9944831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 10KB
SHA256 662510cfd205313c4e961695d354b0034c8c08a52cede184a86dd65b192cfdc6
MD5 8687084dd1efd480ec99a1aec4c020e9
SHA1 9c185c66bad66ae8b3ee40c6d81b1b7a90a4dc0a
SHA512 b4f232edcb8e033a8c92742d84e9a454bbde5ad83e00fad5d7422e153033e9621e21cd5be7e217f3332c34c522c33762ce1cc625c0bd0892741837d4ac8be6cc
SSDEEP 96:3JDr+JKG9rHD6SeSbtqyGjBEpdSMhEMSbCSeRSyH:5SKG9rHD6SeSkyGNEpdSIEMSWSvyH
TLSH
T18C22B89C4DC4FCE859FFE98132984F556F8C25BB561E11F8B640C28BAE9944831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 10KB
SHA256 3449649defb579e988de9bc426547c2b0e31ab032996413ebe38f1656bc7bd56
MD5 6c0f15bbe1993854d3f5efed266f2dfc
SHA1 80b45eda8bf296e3c10d0168a3d6f42a98c88941
SHA512 11e845dc6e92ccd913a266240aa3408177983dbb0f78bd1ac7b86d98b8e5b589ea54457fc942bdcf4b84bc585720743bd2896acf7d29f461d415798d9a496564
SSDEEP 96:3JDr+JKG9rHD6SeSbtqyGjBEpdSMhEMSbCSeRSywSbC:5SKG9rHD6SeSkyGNEpdSIEMSWSvywS+
TLSH
T17422B89C4DC4FCE859FFE98132984F556F8C26BB561E11F8B640C28BAE9944831ECB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23072026.log

Path C:\Program Files (x86)\eMudhra\emBridge\23072026.log
Size 237B
SHA256 e3e5b53769f7ced82945d01e249f1f544a5cf04258cb2428c853b9fccad7ba66
MD5 08d64f5a6e8b2f97a4374563987804ed
SHA1 bb55a6f000d222883d6483bd37e3c206c84e3ae8
SHA512 a2eccc1a1e69ea666918d8eb4f3b9c60fa9e6abf98e53678614ad4fba8c3f546832da889fa0c979ca6417d11f16cae56e2d0bd2621900393215e68d3979340b9
TLSH
T139D0A7810FA0EEF0C9F7E481198F5712775C7177014D169B23409251D84710E359CFB5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Program Files (x86)\eMudhra\emBridge\FP
Size 46B
SHA256 57ccd61637e2d238f1e6e0754b432bf8ecb6df355d9df508a588dfab5c844400
MD5 ebcfd8d781312e97035d48de5fa52f04
SHA1 453432c102933543166d78a869af4cb606478eac
SHA512 8f2cca08a123c6d709800c8ca854a329b2ea25cbcb54b87703bb24ebe92fa0b5c40bdbd4abe93238f46fb537738f680d463226eb12f22ab263dea15658ae30e2
MD5 SHA1 SHA512

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\eMudhra\emBridge\Newtonsoft.Json.dll
Size 366KB
SHA256 ec2c36c86514579e8e960724c9d5fde2793f4fd68bed503b62f2c580b96d863c
MD5 c724acf1b7f9d029c35f80315d3e340a
SHA1 be46844367b53d80cd2ce04cde3af13d8693ad21
SHA512 a9b7c7a9dda599d812c337e3c077fc9d9baa5ed61691e788ad90efa6a6067a70b9a776dae90134aac2d1026888321884a178397c8d002a2ac65e24e24f10455b
SSDEEP 6144:LloGQqyb4RZ6cnsVFAQjCgh5QYRrRr0tIrL7JmQvZ:qGQlBbXCgh5QIlQarLjZ
TLSH
T12D84391163FC472AE9EF1BB6E4700A1407F9F846AA7ED78D6D44E9EA0CA37409D50363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.Formatting.dll

Path C:\Program Files (x86)\eMudhra\emBridge\System.Net.Http.Formatting.dll
Size 164KB
SHA256 e324586890f7c70ac593c3c45d7c607b39b21822c5ef44e3d6fb0f1f57920858
MD5 c0673bfb50e597a571c63f5dacf720ca
SHA1 65b73cfb49befb42070208ba843b1658a33265ed
SHA512 2d39a763d443c76e33a0eeb2556af748af01118aebe3d7b3b18c46c8387597e838868bcfdb4cb5b078bc60e30587a09adfd5f25091f5940df7e5be483042e99e
SSDEEP 3072:Dwa/rSXSx6op7obQc6hWPqnSmTyOF5Iojw3z9ypCPyJxf:Dw4rECSmThrjwDWCG
TLSH
T192F38E2937FC465BCAFB8AB8F53814164276FAA7A516F79E980472FE14E3380C411763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Web.Http.SelfHost.dll

Path C:\Program Files (x86)\eMudhra\emBridge\System.Web.Http.SelfHost.dll
Size 103KB
SHA256 fe26168212efa7504d6cc6f836c565c6e24dc1b7c4907cac7489bc0d0b90322d
MD5 bb040bc60a725a395857a344407cbccd
SHA1 998d30a70e0a36b82513c7a90a43c09c36a9bf8b
SHA512 d8a31c7bcd620d9fc5675f7e0a2083b8c871b8dee39081cefca4835f716de89b1b5c35e23e44629a9f0b3bec9422ce483f49d0a43227c4c11d410cac4ee38256
SSDEEP 3072:KLIGBF2UawjhVsWjZ1lddByVQPUPo141j17p1FAdfOmOMpeXFasS:QVrjiAl/fpe+
TLSH
T18FA35B86B7EC4D1AE7FF6B79F270A5154735F6615803D78E285C10AD48E3780CA62363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Web.Http.dll

Path C:\Program Files (x86)\eMudhra\emBridge\System.Web.Http.dll
Size 315KB
SHA256 ea4c2c88771ad1fab8c1772b75fc9b16162afd94596ff92905d9741047f75c9b
MD5 bdc52f53ae7bbd99d60cdc2156f27bd3
SHA1 03acb5e8aa04de1bb500b3cc2f7947debc97f771
SHA512 fd7338b33e54399f15cdfed2642b26e19123d654a542f85c14b956a0bab3a067ad3be04f14ee4219bb73730746fc7d3488f540182c175d667a7b36f2e7fb71b4
SSDEEP 6144:MJi5a30DY9cf0UQ2TTQQwRWhZZ00000ggg0MMMMMMmMssPDV0SXEKv8h5tQvWCdG:M6aEc4iG
TLSH
T18F645C2567F803AADBDB47B8F431546A86F7FA516005DF0D6684B0E63CA3F918912373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Topshelf.dll

Path C:\Program Files (x86)\eMudhra\emBridge\Topshelf.dll
Size 275KB
SHA256 79036662c985cd2ce60ea2573bd155e65b46ba65f47a62e82ba503643d56fcce
MD5 2c57857a672e57e79790c4324ce62fe5
SHA1 8974ea0171b1c9d561504f6926c2783147b8623c
SHA512 2bcd8b4500d6bfe2dad73fd41b7bc5dfac29ad7d38bcf393513f25ed4c2626e127f82156b55e35070d042657a51e472a0792dd87befa00b702258ff3f1dfc805
SSDEEP 6144:/leMFBgJiZ2qBx/HiGg1VzgMlXcKY4Mf:N75hviDVjca
TLSH
T1EA544C09E7DC9173C5FF8B77E47028004B74FC03A56AE71E1696AAB51AA2B84CD503B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emBridge.exe

Path C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe
Size 6.1MB
SHA256 0d2ad3bf094c196390de55f38fc53aa68707825d4aa32fef4ae1df87e9604d20
MD5 89265d511c1fd476e1885f9de585b8f3
SHA1 49d7f39b267ddfd0fa6f11d8a3e21cbd1d2dbd77
SHA512 1b64cac1ce77b9e02d0e44bb31a710affab8949a56f4cb379d1b08aed4902012da72fa20b33d5eefabd6383afb04823932e7c24a1c819e900552da425d9a980c
SSDEEP 98304:jCUPxoupPqwXtMlcQ+kh7rE/1p8vGOh3qbiMIPy:mumupPqwXiBmOUbiMIPy
TLSH
T18356189C7350B6EFC857C472DAA81C74AB50A4BF970B4317902755EDAA4EA87CF240F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emBridge.exe.config

Path C:\Program Files (x86)\eMudhra\emBridge\emBridge.exe.config
Size 1KB
SHA256 0847f7af6c081e003231af62923d9df6d10e60b1f24aa206caf398f9bbc8fb10
MD5 a23fba0edbf9bcc4ca8f097460fa1da2
SHA1 eea94da66039e8a4c8e3247ed287d08b671e9573
SHA512 0110598489b675a84eede0ec899c1f2a76af9fb96a246f98e6508ba3ebabf3282efc7b21ea2a4f6e9efd63517aec12f7d01c7f62b787361ebd3c3310bfe94e4f
TLSH
T1F121CE326AC4F8A689350D13FE109C41EB2543561782184870EE223FDFB3C4B97971F2
MD5 SHA1 SHA512 TLSH

Submit Download

4ae5a185f2ed879c95e2ea1d2ae26765_d79a0f05-4c2a-497a-8d00-0dd36c0f1d91

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4ae5a185f2ed879c95e2ea1d2ae26765_d79a0f05-4c2a-497a-8d00-0dd36c0f1d91
Size 2KB
SHA256 f5992e5e78458936818494d6d9ce6cb11dda0fd82d62b6b962bfcac704ba1b12
MD5 70499d220fe60a8a126736bd1ceb9656
SHA1 f2ce76815c03bcc91859d7842da23a06875b89e8
SHA512 eb9389cb59bbc7ee854121f57a9ad1c09b0b677d40186cd3e28e37348e19f0f54ec83010e7963a9cc7904c00221c63c14472a0f3bf15942394182b5a612af9a8
TLSH
T132413A00200188F1E8A58DB61A0BDC3C1694DBF7D3F2A784EC79818A2696EC20E1DF1B
MD5 SHA1 SHA512 TLSH

Submit Download

emBridge.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FN727.tmp\emBridge.tmp
Size 3.0MB
SHA256 012122897194ca7f0568e577f1ce6782fe73d8b8e97cc5c16df747880d398431
MD5 82326664f0f67380e8f72735c0a6f537
SHA1 976df3fba9a17cc58e72d03af38ce51e2063ebff
SHA512 fc3f513d4303bec965c716265a854e4e0b47224a1b04d7e260d70b351840632a8e32cef9a09847b29045ff4335daadd3eaf58ee24e6d4f4501da78c2856f3f37
SSDEEP 49152:VWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbE3336r:PtLutqgwh4NYxtJpkxhGP333a
TLSH
T156E53A27F28C713ED06B3A364A3386909837F66179168C2797FC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpFDCF.tmp

Path C:\Windows\SystemTemp\TmpFDCF.tmp
Size 2KB
SHA256 01e53fa710368db82755ac69c19b936bcc869bff6b3959cc857287caad37702c
MD5 5170c11ec89d8f0e87e2ca121a2e351f
SHA1 d3f096441176c7ed5c4bc89a10ec09a8e504d8d9
SHA512 3be751d7b03710148271510a54281e2005f260b891ebc561bbc9fafe9c3fb0a928b63c3dc11b89a2db3a2728a18f9baf3da9ecf7da8bd160cca138e197180fc9
TLSH
T1DA510A438FEE5A4CBC75809C64AB8D125AA45E703D584A0FD1374FD0082DF4D6A5E868
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 257d1b523620c66f0a3d01cecef2c12ed545e7c39ef49e6f3de12bdce3b85322
MD5 cd71a21623446e01ba0c3158eb043748
SHA1 189280d882f5f797b58a3c47b10b8d49db6bd4e9
SHA512 8cd9a37a96c959d882e6b90a33608c8366fc3fe0b8dfe12d0a6f452fe0bbd9df9b7a427a66fb1c25618b2cefaefb36c05a6779d4419f642a62c661fc0764360e
TLSH
T15321BB260649915D26B341E5091CB42FA31FD0EF0E3B8DCD3E8E450F7BA2A0C5366746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2580-78-0x0000000005580000-0x000000000559A000-memory.dmp

Download

memory/2580-77-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/2580-65-0x0000000005240000-0x0000000005290000-memory.dmp

Download

memory/2580-63-0x0000000000280000-0x00000000008A0000-memory.dmp

Download

memory/2580-61-0x0000000072D32000-0x0000000072D33000-memory.dmp

Download

memory/3940-154-0x0000000006770000-0x0000000006782000-memory.dmp

Download

memory/3940-162-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

Download

memory/3940-104-0x00000000046D0000-0x00000000046FE000-memory.dmp

Download

memory/3940-106-0x0000000004F50000-0x0000000004FB6000-memory.dmp

Download

memory/3940-98-0x0000000005780000-0x0000000005D98000-memory.dmp

Download

memory/3940-97-0x0000000004C30000-0x0000000004C84000-memory.dmp

Download

memory/3940-93-0x0000000004BB0000-0x0000000004BCE000-memory.dmp

Download

memory/3940-159-0x0000000006C10000-0x0000000006C72000-memory.dmp

Download

memory/3940-153-0x0000000006A90000-0x0000000006B9A000-memory.dmp

Download

memory/3940-155-0x00000000067D0000-0x000000000680C000-memory.dmp

Download

memory/4536-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4536-9-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4536-149-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4692-64-0x0000000072D20000-0x00000000734DC000-memory.dmp

Download

memory/4692-163-0x0000000072D20000-0x00000000734DC000-memory.dmp

Download

memory/4692-67-0x00000000053F0000-0x0000000005482000-memory.dmp

Download

memory/4692-71-0x0000000005490000-0x00000000054DC000-memory.dmp

Download

memory/4692-66-0x0000000009DE0000-0x000000000A39A000-memory.dmp

Download

memory/4972-148-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4972-13-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4972-10-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4972-11-0x0000000002600000-0x0000000002601000-memory.dmp

Download

memory/4972-87-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4972-6-0x0000000002600000-0x0000000002601000-memory.dmp

Download