f2b3fb1da8609fb6d1a47372921cf67e544659c2abb03459d02919c7ee88abea

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 3.9MB
Sample260723-pd9a4swvbx
SHA256 f2b3fb1da8609fb6d1a47372921cf67e544659c2abb03459d02919c7ee88abea
MD5 3d7795642a47e90074e603414de0b446
SHA1 ad0b067532dab2e17a3aee4d9e636a8c1bfe1051
SHA512 e133fc371e4e91a5a0318ed71a250b7be359c1ac868c3009299c7ba9e71cbd6739ee36b5aed2a5a0981caca7c9ce714ca7249ca025aa64879632100471dd23fe
SSDEEP 49152:dOawyL6C268yilHOysMya2/eVDzxE0kGaDWfd+gQRHtaeaN/En+7O7JFpnAkFQXP:YCL6DWilHOysMya/EpJ0kFQXUyd37y1
TLSH
T103169D12BD944577CA330731492AFA3931AFFD742F34968B53483B2D6F322E2162956B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
4	3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
8	3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Executes dropped EXE 3 IoCs

pid	Process
2152	msedgeupdateres_zh-CN.exe
4188	M365Copilot.exe
6096	M365Copilot.exe

Loads dropped DLL 3 IoCs

pid	Process
2152	msedgeupdateres_zh-CN.exe
4188	M365Copilot.exe
6096	M365Copilot.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	M365Copilot.exe
File opened (read-only)	\??\I:	M365Copilot.exe
File opened (read-only)	\??\R:	M365Copilot.exe
File opened (read-only)	\??\S:	M365Copilot.exe
File opened (read-only)	\??\T:	M365Copilot.exe
File opened (read-only)	\??\W:	M365Copilot.exe
File opened (read-only)	\??\Z:	M365Copilot.exe
File opened (read-only)	\??\B:	M365Copilot.exe
File opened (read-only)	\??\G:	M365Copilot.exe
File opened (read-only)	\??\N:	M365Copilot.exe
File opened (read-only)	\??\O:	M365Copilot.exe
File opened (read-only)	\??\P:	M365Copilot.exe
File opened (read-only)	\??\U:	M365Copilot.exe
File opened (read-only)	\??\V:	M365Copilot.exe
File opened (read-only)	\??\J:	M365Copilot.exe
File opened (read-only)	\??\K:	M365Copilot.exe
File opened (read-only)	\??\X:	M365Copilot.exe
File opened (read-only)	\??\H:	M365Copilot.exe
File opened (read-only)	\??\L:	M365Copilot.exe
File opened (read-only)	\??\M:	M365Copilot.exe
File opened (read-only)	\??\Q:	M365Copilot.exe
File opened (read-only)	\??\Y:	M365Copilot.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
18	api.ipify.org

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5080	tasklist.exe
4164	tasklist.exe
3192	tasklist.exe
5372	tasklist.exe
260	tasklist.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4912	cmd.exe
568	cmd.exe
3340	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5512	6096	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msedgeupdateres_zh-CN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M365Copilot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M365Copilot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
2396	timeout.exe
1060	timeout.exe
3516	timeout.exe
4204	timeout.exe
5240	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1688	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command	msedgeupdateres_zh-CN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings	msedgeupdateres_zh-CN.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open	msedgeupdateres_zh-CN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/{67340B4C-1D50-451A-995A-05E97B64FF02}v96.93.26399/packages/M365Copilot.exe"	msedgeupdateres_zh-CN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā"	msedgeupdateres_zh-CN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open	msedgeupdateres_zh-CN.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell	msedgeupdateres_zh-CN.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command	msedgeupdateres_zh-CN.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings	msedgeupdateres_zh-CN.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell	msedgeupdateres_zh-CN.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
4188	M365Copilot.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	M365Copilot.exe
Token: SeIncBasePriorityPrivilege	4188	M365Copilot.exe
Token: SeLoadDriverPrivilege	4188	M365Copilot.exe
Token: SeTakeOwnershipPrivilege	4188	M365Copilot.exe
Token: SeTcbPrivilege	4188	M365Copilot.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	4188	M365Copilot.exe
Token: SeCreateTokenPrivilege	4188	M365Copilot.exe
Token: SeAssignPrimaryTokenPrivilege	4188	M365Copilot.exe
Token: SeLockMemoryPrivilege	4188	M365Copilot.exe
Token: SeIncreaseQuotaPrivilege	4188	M365Copilot.exe
Token: SeMachineAccountPrivilege	4188	M365Copilot.exe
Token: SeTcbPrivilege	4188	M365Copilot.exe
Token: SeSecurityPrivilege	4188	M365Copilot.exe
Token: SeTakeOwnershipPrivilege	4188	M365Copilot.exe
Token: SeLoadDriverPrivilege	4188	M365Copilot.exe
Token: SeSystemProfilePrivilege	4188	M365Copilot.exe
Token: SeSystemtimePrivilege	4188	M365Copilot.exe
Token: SeProfSingleProcessPrivilege	4188	M365Copilot.exe
Token: SeIncBasePriorityPrivilege	4188	M365Copilot.exe
Token: SeCreatePagefilePrivilege	4188	M365Copilot.exe
Token: SeCreatePermanentPrivilege	4188	M365Copilot.exe
Token: SeBackupPrivilege	4188	M365Copilot.exe
Token: SeRestorePrivilege	4188	M365Copilot.exe
Token: SeShutdownPrivilege	4188	M365Copilot.exe
Token: SeDebugPrivilege	4188	M365Copilot.exe
Token: SeAuditPrivilege	4188	M365Copilot.exe
Token: SeSystemEnvironmentPrivilege	4188	M365Copilot.exe
Token: SeChangeNotifyPrivilege	4188	M365Copilot.exe
Token: SeRemoteShutdownPrivilege	4188	M365Copilot.exe
Token: SeUndockPrivilege	4188	M365Copilot.exe
Token: SeSyncAgentPrivilege	4188	M365Copilot.exe
Token: SeEnableDelegationPrivilege	4188	M365Copilot.exe
Token: SeManageVolumePrivilege	4188	M365Copilot.exe
Token: SeImpersonatePrivilege	4188	M365Copilot.exe
Token: SeCreateGlobalPrivilege	4188	M365Copilot.exe
Token: 31	4188	M365Copilot.exe
Token: 32	4188	M365Copilot.exe
Token: 33	4188	M365Copilot.exe
Token: 34	4188	M365Copilot.exe
Token: 35	4188	M365Copilot.exe
Token: SeDebugPrivilege	3192	tasklist.exe
Token: SeDebugPrivilege	5372	tasklist.exe
Token: SeDebugPrivilege	260	tasklist.exe
Token: SeDebugPrivilege	5080	tasklist.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
2152	msedgeupdateres_zh-CN.exe
4188	M365Copilot.exe
4188	M365Copilot.exe
6096	M365Copilot.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 2152	3744	2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe	88
PID 2152 wrote to memory of 4912	2152	msedgeupdateres_zh-CN.exe	89
PID 4912 wrote to memory of 2632	4912	cmd.exe	91
PID 2632 wrote to memory of 4188	2632	ComputerDefaults.exe	92
PID 4188 wrote to memory of 1688	4188	M365Copilot.exe	93
PID 4188 wrote to memory of 568	4188	M365Copilot.exe	96
PID 568 wrote to memory of 3340	568	cmd.exe	98
PID 3340 wrote to memory of 4164	3340	cmd.exe	99
PID 3340 wrote to memory of 2328	3340	cmd.exe	100
PID 3340 wrote to memory of 2396	3340	cmd.exe	101
PID 3340 wrote to memory of 3192	3340	cmd.exe	108
PID 3340 wrote to memory of 2752	3340	cmd.exe	109
PID 3340 wrote to memory of 1060	3340	cmd.exe	110
PID 3340 wrote to memory of 5372	3340	cmd.exe	111
PID 3340 wrote to memory of 4260	3340	cmd.exe	112
PID 3340 wrote to memory of 3516	3340	cmd.exe	113
PID 3340 wrote to memory of 260	3340	cmd.exe	114
PID 3340 wrote to memory of 1300	3340	cmd.exe	115
PID 3340 wrote to memory of 4204	3340	cmd.exe	116
PID 3340 wrote to memory of 5080	3340	cmd.exe	117
PID 3340 wrote to memory of 1456	3340	cmd.exe	118
PID 3340 wrote to memory of 5240	3340	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_3d7795642a47e90074e603414de0b446_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\150.0.4191.82\msedgeupdateres_zh-CN.exe
  "C:\Users\Admin\AppData\Local\Temp\150.0.4191.82\msedgeupdateres_zh-CN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    /c C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\ProgramData\{67340B4C-1D50-451A-995A-05E97B64FF02}v96.93.26399\packages\M365Copilot.exe
        
        "M365Copilot.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4188
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BF0DA42BE61C5A096FF.BAT
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C C:\Users\Admin\AppData\Local\Temp\BF0DA42BE61C5A096FF.BAT
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq M365Copilot.exe"
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "M365Copilot.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq M365Copilot.exe"
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "M365Copilot.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq M365Copilot.exe"
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5372
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "M365Copilot.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq M365Copilot.exe"
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:260
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "M365Copilot.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4204
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq M365Copilot.exe"
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
        
        C:\Windows\SysWOW64\find.exe
        
        find /I "M365Copilot.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5240

C:\ProgramData\{67340B4C-1D50-451A-995A-05E97B64FF02}v96.93.26399\packages\M365Copilot.exe
C:\ProgramData\{67340B4C-1D50-451A-995A-05E97B64FF02}v96.93.26399\packages\M365Copilot.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 748
  2⤵
  - Program crash
  PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 6096 -ip 6096
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PDFCore8.dll

Path C:\Users\Admin\AppData\Local\Temp\150.0.4191.82\PDFCore8.dll
Size 3.5MB
SHA256 3e42412700130b62c7265be6122c064280a56e519d6074c677f7ba3c541bc960
MD5 1f3ea36c7cc9f502fb0f53bd7f27f0de
SHA1 fb54bf916c8f51018ce729b9df23960fff0d8405
SHA512 e8fd981f78b83614678c0076dcfc99307047d24ddb3a13cda6b98fc5c1b60b22bd84e2b5e49835fcbc7c2226e787fc9ba33bfa105426e8ae12998b412defc6ac
SSDEEP 98304:sSIgCa4nLYNSaFCGt4AKmlszpaoMX+F1yHTn:sSGnLnQMAKmlkcobFE
TLSH
T19A06E01235814077D29F86B04919B3ABF6FCB57027F641D737B4DA8C2D72482463AABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_zh-CN.exe

Path C:\Users\Admin\AppData\Local\Temp\150.0.4191.82\msedgeupdateres_zh-CN.exe
Size 2.5MB
SHA256 88e32dfea6c94b16a89e9c3b66a01f5bc1c99b4abddb48060cbe5c06b77907d3
MD5 b3fb19b6aed79b6ee2000090d6d9d258
SHA1 80e6b37cef32e41e689fd1f8a85d43e872e39f89
SHA512 860717b403094c6b9f991eb5a495a6fbc8e5b5cac5707942f6c2a8acc4998c183d70ebab5aa95885d48a6c5237c137d70dd5144b3b552931f61cac858162df8e
SSDEEP 49152:IeNB2g8nh04anNzgo73S+D0Q6QdlCoFodTYgd8ZGtceT2t8EiZrnBzrBxq:I+25h04a1gsS+D0Q6QdltFTgd8qceT2t
TLSH
T110C57C326B4290A6DAAD3D3192DD533D92B5CFF6BA3DEC775650383C6674482AC2012F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BF0DA42BE61C5A096FF.BAT

Path C:\Users\Admin\AppData\Local\Temp\BF0DA42BE61C5A096FF.BAT
Size 860B
SHA256 d223c8e605377bb9ea4d4a21dd0eb20d62cd6bb28ab3ea93fbac4ff90852a09b
MD5 051c1aaca72e674e2ed7ea5592acf5d5
SHA1 5ac95a424fcd02a469db2fe5597f38fc93422b1b
SHA512 179618824ddad904c0291702bb09cf91ff0842ba30d6caae631f73ac5f23885f73cd46ecc43c8e5c6fbf66508415408440833ebb3ad9d0366412dd36f7ab4706
TLSH
T16611508F910B685C07F482B778954E054B9DD043F73762D87000D7046F6A80F54C535C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4188-29-0x00000000049D0000-0x0000000004A27000-memory.dmp

Download

memory/4188-30-0x00000000049D0000-0x0000000004A27000-memory.dmp

Download

memory/4188-32-0x00000000049D0000-0x0000000004A27000-memory.dmp

Download

memory/4188-33-0x00000000049D0000-0x0000000004A27000-memory.dmp

Download

memory/4188-34-0x00000000049D0000-0x0000000004A27000-memory.dmp

Download