stihat | d0771be18b0c9df5e5d1c64e3e98befba73a79bfdfb771c884e7e7cd4f037f1a

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
Size 3.2MB
Sample260728-2dgbjsxfpd
SHA256 d0771be18b0c9df5e5d1c64e3e98befba73a79bfdfb771c884e7e7cd4f037f1a
MD5 9b0f13a246f8055584a9bc8ec85977ab
SHA1 fff4e60b0076f244603c9b8a911c82945651a791
SHA512 44368efd07e6476a3b7bba09907f77ee730c79eed87491b1e74964adaa1a67729d7f1e1d8829c13fa77728a3d5bd61b52f7adb8ddb0d87a1f2a63af2fb5913a6
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCf:eEtl9mRda12sX7hKB8NIyXbacAfuKJUT
TLSH
T149E54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 9 IoCs

resource	yara_rule
behavioral2/memory/3332-0-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000d000000016cdc-6.dat	family_stihat
behavioral2/memory/2172-8-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/files/0x000c00000001c54f-31.dat	family_stihat
behavioral2/memory/3332-42-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/4920-44-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/2172-45-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/4920-54-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/3332-0-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d000000016cdc-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2172-8-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002f-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c54f-31.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3332-42-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-44-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2172-45-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-54-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
2172	HelpMe.exe
4920	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\P:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\N:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\W:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\D:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\L:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\R:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Z:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\B:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\J:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\V:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\K:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\M:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\U:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Y:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\A:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\G:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\H:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Q:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\I:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\T:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\O:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\X:	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\AUTORUN.INF	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000064ff3facad0fdd019a2fa438b80fdd01f353fc3cb80fdd0114000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2376	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2172	3332	2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_9b0f13a246f8055584a9bc8ec85977ab_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2172

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:1900

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.exe
Size 3.2MB
SHA256 22e5a803c260e995af5930ef1ecf3618a835b69214f7f66a6db03b2e0deeaeaa
MD5 ace36cd57931160dbd51003e177176ce
SHA1 1382e402452892ec16d013a1af0d33709d70e0f8
SHA512 9c4937177b745fc85a5c4969da04a674ce59ea87d3be195da2ff9b85344e6aa8796fdb20bf03adac05fbe016b57ea36fa7ec1f675974167b2ccd5b74ecb8f6c8
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCl:eEtl9mRda12sX7hKB8NIyXbacAfuKJUZ
TLSH
T168E54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8bccd6fbaaaabd120ed393621957eba2dab4cbeb7bff96697dab0ae2ec32e6ce
MD5 2ed1c00400a9594e38b4dfd1ea285e14
SHA1 053f8cf2bf3d1e73aef42aabe4e5ee6c067225af
SHA512 cd31df7c805d3067615b4ed7100751b556743afdda1f8fee59252a2fc287e1bfc8a79331b7bd5faa08a22ba841178f919df44b46b6e53b56461d8ffb8d11e755
TLSH
T15011EF0955B13B35C3B1833685BB2711F333BE02F5B19FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e126a73096ed05f0bb3674423b2f03e7dca3b5e69248317afdee2140ddbedc49
MD5 28adc6dab3c8cbb69f2bae868042e3aa
SHA1 3659484c8e90b2b629609b2a0450b48a0952a17f
SHA512 95fb4ce8738c356084e4482feb0b564bddda9692fd2be8b96b452ff020f1c1c44d865b3fee1bc526bdfb23d30e94153a2e42fec0f23b75f8955efb4b31c9e0d4
TLSH
T17011EF0955B13B35C3B1833685AB2311F733BE02F5B19FAE404A43866894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 61390dd86b5a2fc706dddc7469b3c04991d018ec6e63c8daff0210767b5703d2
MD5 ec70ef118737ce7f9783d7f7df82bf22
SHA1 f863909b4aab96e09b11e0fe412a033a5db6a8ff
SHA512 b101272075096ce575c532cd4e58c550d2a0bb946e76fcd286afa8c6a053c90cd462b670245104df6b5545a526b2760a65873a9df14fb42b355446df4c889408
TLSH
T1BB31FE0556EA1B62F37BD734D5F72513E532BDD1BA50AE4D0044524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d5cad0c99cf5a193ab0f86df3aab19e48ed94d7a04cd021429d50960aded1e43
MD5 3a8ae65300196ff2b3c91bae41e18c13
SHA1 8949463d6b5717b6c00aca7c9cc262e09dcad95f
SHA512 ed5f495c75e1838ab6bc60f905c3cf7e3a8f14971328988318fe09bc44319d38204d5588e3123df12831f606d8e23c1ccfbe80a7dd43d8920b0a8dd1c0db287f
TLSH
T17F11CC0955B12B35C3A1837685AB2311B333BE02F5B19FAA408A43456894201AE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 41f4442a625f4b5f03599cdfeebb9ef5772192566c39b30efd818a0b20086083
MD5 aad12633c9551e57fb12210e4572b08f
SHA1 317122dda3aa13bbce12cb0f7c2c60ab76fa97b2
SHA512 3a2d73d24720b3d7523c5ac5300d61072fddc8365553a7afde600c3ffde1ae756dc17fa65c8969fd219bde81077aca7f81f5433b34cd0217d494c371e94a8e2c
TLSH
T16231FE0556EA1B62F37BD774D1F62512E532BD91BA50AE4D0044924A0872B82BE80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 adcb9316ba11835411eaf14cc0186db215f59466e64ff1ce37166c164f537f97
MD5 f96748b997d9956a43e14c621346fc78
SHA1 723b6931580a881ae659490610c7113c8d42de45
SHA512 7aba2b5938f6e4f986f4d2a97735e2a23dc4aea20782d2c123b9f453aa745a83269f2f944e6d35144561f8ce4b4b0188d9bb0f1f998b46584d5591c8b34ab876
TLSH
T17A11CC0955B13B35C3A1837695AB2711B333BE02F5B19FAA404A43456894201AE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 62cb13f201ebc64e4245bbfbdbed135f42220ae787ce2af35f638f8e3e751113
MD5 108076e60d5597758da1a4fc263b6bda
SHA1 6e6cb5b6ca9ba7754e44e226119f2b42c90f65dc
SHA512 49f4936a60555a519ecb08c03a43850f7d5982602f5988d5f8960749e121628f45069939639eee22ff3694260f8c00085bc9265a4b7749bf4033652c3fd29475
TLSH
T11031FE0956EA1B62F37BD734D1F62512E533BD91BA50AE4D0044524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f66bb439b21c77863d24062ee58d1b6a6ac882dd7342c1b2debae6a169feae81
MD5 9a0f9149b7d2c7736b2d95fa9e5f8626
SHA1 31e6b07b140b5cf933d2d386e7c8c7cb08c6fb34
SHA512 499f9d96cc86c224712f799482b3e8ab6385308c6a8753e04df05d9f605dcc40434ee89980d221d78e42c39b5530557d173699808838e347d87740c9c01a1d30
TLSH
T19811EF0D65B13B35C3B1837695AB2311F333BE02F5B19FAE408A43456894241EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5b1d8049c06e9d1615a72638725ab2fda09dffeb6a8d18ad0470afb42344d44a
MD5 c61fe86fa701ae5659a9120306d42bfb
SHA1 7163f88e543f83ba736d74d6e6ae08f41c92f7ba
SHA512 0c1d8a47921b990edb07183c9ec4bfc935f35558f64eb6b10ec716bd4ce0da8057a7cf1f9a5ca75985a22c2662354d663139ad2c126c9eee30be20ec48b3d110
TLSH
T11411EF0955B13B35C3B1833685AB2311F333BE02F5B19FAE404A4345AC94201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1fe230f5694c11a605b26eeef4884dd8128bd89190494afdaad3f5beaf2e71fe
MD5 7c83cf4c1deebb17e4c0f46427bdd68a
SHA1 6495aadcde94fb335342852e035479284418e977
SHA512 521d82bc2f90e596a7002bca60a767bb188eb22da7921514ddd0c3ddf8a2e7f73bca0f48e0fee82a48c7fa7c2df67268a9f89999e07fa7410e498dfc65b210d5
TLSH
T18231FE1596EA1B62F37BD734D1F62513F532BD91BA50AE4D0044924A0C72B82BE84F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 cde2fe9de6f786442722c524f63b98b3803c1fea2ce3c683b04467e845dde893
MD5 f3566ec0a7d6636397344d06df50c282
SHA1 c75fd680aa0093cba8fb193835fac8c6a0aacc56
SHA512 7a7f2dccd525e117420ec077015c5df20a294fd73d8e687cc54cc2b80e9f914e328a258e878c459a6ef0a3d7d0288bea65ac38adf623274606f7319383443d0e
TLSH
T1E711EF0965B13B35C3B1833685AB2311F733BE02F5B19FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 81ab5361d4c49aa02b2e43cec5dfc2dd0d9fa223c0fe8f2843c3f971d96855be
MD5 ad119a073f61b9bdf3a7e3ceeb4a1a20
SHA1 2bee45334431fdeed7c0dade8f8e1bc35975ab0e
SHA512 0846dd00884d5907fe574845c011651edf2223f3ad5e9f8c6163fc4c2928f39a2a4845286346d3c5c67576fb018aef4975135566bd8780597af18fbb0d949cca
TLSH
T1A331FE0556EA1B62F37BD734D5F62512E532BD91BA50AE4D0044524A0872B837E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9ca2fb4b4cf6bd99feca9583fdbb7b05f035e47dac5ccd64408aa1a4598a491f
MD5 6299c989409e26b5419e0e61c398295e
SHA1 202c16ccbf49e21036588b76a70f4af7afcc11e8
SHA512 bbf0c370ce9d1303dda80c287187dca2cdca930d07679d6240dcf76eedba0f01b80db982c8500e1d176a891bbb51980cf0c1c1e0e0ddd99bd22d40ab8afc8690
TLSH
T15611EF0955B13B35C3B1833685AB2311F333BE02F5B19FEE404A4345A895201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cdb694628fe44a9167adfeb64cedd561c718ae1067609fceef8c418e94edea27
MD5 569bef2531e317b3c8fccc97437bc500
SHA1 57ace76adae873651e8426278f0e948dd152ed9e
SHA512 8aaca231e80842725e697713de8ef14efa9ab3412df415b080bf9dc76ad3912dfbcf1ce0393b816a1461d53d65194cbde4aac1d990d5054fc8be8fa66306459b
TLSH
T19131FE0656EA1B62F37BD734D1F62512E532BD91BA50AE4D0044524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2d97595be6e6ba64513c3623836d552d6dc188c76151c654ff959179748b6d23
MD5 b73034f56142f57176dda8a94b0a9a93
SHA1 673c9d866a91441e6658fb96c98462673ad9cb0a
SHA512 f05749a79b745a2cbbfd29234828443dd91ad5cb47a6ef430fccc0d38fd9e9abd3d7de6ec31f0abf8d03889f870cc6e1ed208b4a782890447fcd416401c4756f
TLSH
T1CD31FE0956EA1B62F37BD734D1F62512E532BD91BA50AE4D0044524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 694f4dcb41bdaaba7c3a987608954942fa195e3ea9dde517fcbce765b393a31c
MD5 85019e38f442b75b33a741fc01906532
SHA1 387b96bf6a86ca22467ed768b44aa9f7153a3910
SHA512 68a078ea15efdfdda3fdf418e72c127763d0218bf172ec4792c550c9d0fcf7ceb55a09b0a75dd541f180397818b8d284c01b2a41761a30b9ba109ce4c83e64f6
TLSH
T1D611EF0955B13B35C3B1833685AB2711F333BE02F5B19FAE408A43466895201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e28bb7a9f84ee3e148d1aa322b00f644bbe11631fd3257826730b33d95dc2289
MD5 9743e4b5e3cce20a35ed3bb9cc7d90c2
SHA1 42af1b06da6d980a30da9069f238c041dbc30ac0
SHA512 dd865d0305c71fc9c7557bb7cab0b24996e0ee3359da7fe2160281cbe9f9265ffe6fda71c40a939a5224da23009a1d791f121abc816f9c0fafcb08b79c367b57
TLSH
T19231FE0596EA1B62F37BD734D1F62512E532BD91BA50AE4D0044924A0872B83BE80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1331a472988b2f169e990b9da05f023eb731cb6a01e2fc6e5da1844ce1892c8c
MD5 f640eba7a92d368a3eaab172ef8d1018
SHA1 62ce647f727fa2d904c077e03d5c1762daeffc86
SHA512 b4fa70d62789d1223fb1596c9e1d83ca351ae4d913f90156d612550d9579957755682184a8d2d2af089c8e9df3951d2e6780188c34ed5aedb5c896f5b7e02af2
TLSH
T14D11EF0955B13B35C3B1833685AB2311F733BE02F5B19FAE404A43456894241EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e55d1a4a1ff7e6e4352fe45827d83c224e6822d1c1697c632bf2ea9e34f767f3
MD5 8329c391422e0e7c383ec281c876a919
SHA1 a5cfa01a82aff3226a7eaef14e1989c65e0c07e7
SHA512 354793c7a6e9cf74bcf7074c6987a23054c502a0503cbc825cecae418ec229892a489f1ee457f9f708c0033c27218f86e2f12eed22896873ac715f942a61caaa
TLSH
T15431FE0556EA1B62F3BBD734D1F62512E532BD91BA50BE4D0044524A0872B82BE80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d74eeed7edbfebbddf9465c61d9f039ddd12faff985f12b435ee4baa885adcd4
MD5 4c413eb92d9a19b8c1b025091a559116
SHA1 4a4641651f5e9eb7ba3e95bbc20cd5cecf297ef4
SHA512 b6fb2b9d7451fe47d766379b28caa46c502f8274146c9b8700248f2b4db2b056c7b6bc79c6f1aadb096cb1cb4d83a8c2a407dcb4c000255eef12a27b4834a1b2
TLSH
T11211EF0965B13B35C3F1833685AB2311F733BE02F5B19FAE404A43456894241EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7cb8e927a682311293cb564531c6d4a0b79e5ab10b9694644cdc4c44bb43f261
MD5 37b9b59687652a3b9137f22b36d90651
SHA1 10c3587fc6ff44a233bf801791fd1d4ecd2f61b3
SHA512 f545baf3b4e5b02f1651ce19bcfc25453a598628ad07e19683db3e1bcb29ec8d20ec41eae09a195260889328c93b2137ffdd528dddc116963742bff37e426f60
TLSH
T1B411EF0955B13B35C3B1833685AB2311F333BE02F5B19FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e7ce7c5a56edcbe07c6375a96019feb3e9410f422134c77a0c4bd69de0ce282c
MD5 bdd2f39f7e2fcff6850deae30062560a
SHA1 58e46e19d2f89857bbffbb8aa7dc2036f8e99eee
SHA512 d7e16da09ed6e9843b16f45b71cb1cde7f079f188a43ea1a637d7c21c9965bb9c116d5406bc129f672b21bdcbad5c34a101d060defe579bbf59f2abc926d7132
TLSH
T17B31FE0556EA1B62F37BD734D1F72512E533BD91BA50AE4D0044524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 4ed23bb7725ff1acd10660247624d65d8d8f826c72680b875e466c83c369df05
MD5 6402101903ca7c0c944c918e136ebd29
SHA1 61a0831209ec2b48cd27ba6f23705dd3aefe8118
SHA512 153e3e450b31a48766b19ab22ec0cc7234fe88c8024b6b1d55efdb295cc0128ba1e4bb9c69ec87657187cb0fb3f061ae357afebe2d3b9d63c4bf3dfb86abbdb6
TLSH
T16F11CC0955B12B35C3A1873685AB2311B333BE02F5B19FAA408A43466895241AE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3b42300c7b476992799826fd816633c7fd05fe829c3ea35046f4cb209aa07788
MD5 a9363635b994ddea1bf64e589c0de869
SHA1 e63be352c6a61d4ccd3921c38664bed3e6243297
SHA512 a7b14168e70173026b37148e939b91f0eb58a06bf8fe82e6d7149dfe313302f441ce20e326f5d2c7677d1de98e73bfc26ffb72cbcfd904cfe4e61b47eef3a2d8
TLSH
T13F11EF0955B13B35C3B1833685AB2711F333BE02F5B19FAE408A4346A894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9daf8c04011903ed42943d644fecd93f11451519885ad7364eed0b664db96913
MD5 8f27bd6e4fcf7345d2ac253bb87cef25
SHA1 597deafc905580d8949bd493bf3ab3ccffb2e104
SHA512 86f43f697609b585417bdfd8f5e96676256f2cf47928f4021c4a5df5995cf3242c4c02381215fcefe0fa0041ae09fc976d96ab744bace7f17365b695a87fbdf7
TLSH
T17831FE1556EA1B62F37BD734D1F62512E532BD91BA50AE4D0044924A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 541a25c6a04eb538b8a0878f13da530211f7d3c763461fd921f9035dd9722d23
MD5 46f6ee098252dd1690afa7ca52dcdee0
SHA1 f6bb6f5d09d5d9af825c030a7043c4c03b653da2
SHA512 4a49d530e6fbcd14b66d4330ad1e94d5f22a9f072633789af0dc964a45ea550471f8c616fe991743dc3c6bbd8fb0f93d8479760619673083eb3adf6ad7d3fc83
TLSH
T19C11CC0955B12B35C3A1873685AB2711F733BE02F5B19FAE404A43456885201BE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 57961adeffd1376495d90aeae03e171622e3b2fb85164dd8c335ec495ce7a2ca
MD5 2eb6c0da5ce6589c0d103388e429984b
SHA1 cb691da0d8da06d42ff4e2721009b32d2ef22942
SHA512 ddc59bcf5e2286d4fc4a1a1e565fcbad12091506777394b410cd653a8de5a7c7c0ea275d244a9bc47e4687a4af09317fbc4d0df2493660f727c56944dd655f67
TLSH
T1BD11CC0965B12B35C3A1833685AB2711B333BE02F5B19FAA404A43466894201AE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 588cdb7a84191a515ea74702acdcb7def5b16f5df04ba2613aba97a92d867c41
MD5 d3e53568fe0a8ed768c033b93aede5d2
SHA1 bb43f3b4b2fc616425cffafe67c9fbeecc1a37fc
SHA512 32c3e013f269aab4bdd7e02a53a206a8af7c9b72bc2d3be245f58deac43fa0bde21dec8563e2e4aa9fbe686d98a239a5bbeccabe6eca726616d5c1734affbdb5
TLSH
T12C31FE0556EA1B62F37BD774D1F62512E532BDD1BA50AE4D0044524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7abc67fb3b014c637caba24061523199391f919c0bf535ccd66ba0ba8e350810
MD5 f2e05ed8de5fe1fbdfca2522b436d324
SHA1 59e238d41aeaf013cd55fe1c6fa7c1c1856b6d29
SHA512 3bc16205c7f2db7b9a8ab6d30baa963458e83f1cf2099474bba7fcdb028472d80cd843237de1e3a9af72f945fa9b7ec4bb9097b86bb077424c0a824cd443e041
TLSH
T13011EF0955B13B35C3B1837685AB2311F333BE02F5B19FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 66869d3604da951feb7205564115707e28b26e603b73d104b0c608a42f1048b5
MD5 c00244e6bf802db92d13cf664ed1a9cf
SHA1 5275ce6562ffdfb618f8c636636c4cdd8aa95426
SHA512 3d66a26d4006f3371808d97edf8baf6b469855d087ccc1ebc41d080480346e024cb65441bfd67ef8d3d718f32d96f7076c9375266d69bf09836827eb8b35abdd
TLSH
T11C11EF0955B13B35C3B1833685AB2311F333BE02F5B19FEE408A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0e692f03d72f623bba47a1bbd3f7390f60d9188efb11ed23f8ac9e3d434f1e8f
MD5 33044fa6bb96a0f62d9b69c7cb67cfed
SHA1 8a9f2ff7df00b458765a2bb95b877f7ca004d2cd
SHA512 b4690e9fcbdc5e4cbad74c3b6702038bb5c51905e1ddaa12511b80c3fde3acfc5ea8fd3ec2b4d92cdde81a007a5bd7b65607a575f0ab4fc0ba059cc34d670954
TLSH
T18631FE0596EA1B62F37BD734D1F62512E532BD91BA50AE4D0144524A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5fa713241d7c6521323f78657bcd222c92a940b6ac9428e5a5783316d58d9ab2
MD5 c3542be6dfd9bc74df5a3c96097b4f0d
SHA1 842ca87c4bcd98fbd21a6a8130c7a9f3eae4a1f7
SHA512 c0e754c027bf32c9f8f6c7d65086083b5ca56a436521bf3b50eb733573e143287c85ea7978519f7a1618bb55833bb45b2afef0e1a994cf5f6c8178b50a7dafa5
TLSH
T1FB11CC0955B13B35C3B1833685AB2311B333BE02F5B19FAA404A43466895201AE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 008acdbd8bc1de98b20dcd152cc3f2e02919bc6bbdef95d8f4b96d0966b05039
MD5 389e0ad8e1479821e00d10b0bc431aee
SHA1 0ab5d70e3089ba71e51157b3c02bd0c6dbfc5f68
SHA512 d8b9de29d734c6bd5a220ffd56b3ebbe7831fc17ef8639ba7eb4db414917c6f72778c5ed61d6ce27132af7160737e8aaf0c9087ba2777850f2487f8da808920b
TLSH
T1B331FE0556EA1B62F37BD774D1F62512E532BD91BA50AE4D0044924A0872B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3cddd02aed8652cdddf5535212ccf7382d7d6d034f7ecf8d412f1522bbd143a8
MD5 3f75cbb9e650b41683cf605aa2680d1c
SHA1 606a698e1ca70e4892a29d2d4136adabb62af7f3
SHA512 6e0e9f5dd68eccf8f4dfb675e1a49b3f15a42b3fbda9e41c16a39b2e8d08af08502cfa24815ed84c59fa9e7de40691f9a8fdddb578b5f9bf748c2d75b23ecf41
TLSH
T18311EF0955B13B35C3B1837685AB2721F333BE02F5B59FAE408A43456C94241EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 15bf64aa5a3faed566e4c1ebf26e16aae34007d0427c8e6073b8e1f0d2a43d4d
MD5 bc5978a6e17624510049f0c91f424724
SHA1 372f6b1baf4bfa56b7f18e496acc976971b48033
SHA512 4945ac2992d1b653d2c04850b245995b30c78052a53a991542d88cb24fb08bef0901d42f6ff092299d7f1a265d0857bc7ff55c629cec4e461c96fc1a2d9865df
TLSH
T13311CC0955B12B35C3B1833685AB2311B333BE02F5B59FAA408A43456894201AE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c4bf5c7a85fdd542a8995172412c1d318a346b6189abeefe8d656b0ea6ad5e8c
MD5 a2c8e3446beb2b601c43c68aced5dc3f
SHA1 f9ac3fe8138afcbb849477ee7d0702a2b9321b0d
SHA512 425fc7b7489763b5c7acfbcf790f43ed1294e1a911c51270bcf891af969e2e1f3fa5e7843833683f46d0cb11efb6bf33d68228747ba8d75779e4eb3c7b6bb674
TLSH
T1A231FE0596EA1B62F37BD734D1F62512E532BD91BA50AE4D0044524A0872B827E84F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 cffa01e4e3ff5fe8c299053e102aac48c2f54fb4376f8bf8c43e51dfb262cd54
MD5 c7a71dd9a5c41d80b45eec30cabd86e3
SHA1 372cc6085ee7194459eab22b19defc9af94de184
SHA512 e7893ab9d45b4a7eda183829e0669564257b68ad41751a9c5fcec36e7673ab276dbc71b3100885fa89927fc49b1ffc93d5869ba957296db7229759e7115f7da9
TLSH
T15A11EF0965B13B35C3B1833685AB2311F333BE02F5F19FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 914feeec74249ace71d328533fb468e431b3040c30f52ab5779564a6e11152c5
MD5 39df53ba5e1f001bda9e80ef7efa72ad
SHA1 fa9d7e3aaba930089f9915efba7e1825befd9558
SHA512 f98326c7e4f4b59e3efa69a49f1640f2f00fe75d36194197353038db79b57765362e2ec0de122a77d1a8669bb966a028479007731b652f5e8d6016856babfd3e
TLSH
T13811EF0965B13B35C3F1833685AB2311F333BE02F5B19FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8bd9b5d9c48e5c2ea0c9bf59bce75fcf3f11c7c616fcd5475a194dfb9c05cbac
MD5 dbefa0a7803bbfd2c625fb732c7fc448
SHA1 e77f2e0171d4538279ac5e9068067d70f2138553
SHA512 59a58442b519ccc3dccc7d4f1470ba1ac43c125adda8097f9c829677312a36701b4b4340e9007230c6828dfb241366f351583cb869f910da15758d6b7dfe2c1e
TLSH
T10D31FE0956EA1B62F37BD734D1F62512E532BD91BA50AE4D0044524A0C72B827E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 cf2d3f7a6f446955b150489bf88da918a9915183cbcfebbe22488410676aa6d5
MD5 0ce3575bc4517809a750e7d09354c1be
SHA1 ef525f6894136591d842a8ea2a9d4914ad381c0a
SHA512 15cd1c7e913ff94c04529051c658057271e2ded3148d2097ffc43e5f7e677f82dd020e66505ae36370bb59c8cddd6e792b475bf577c7f313c0d1f445b80bb1d0
TLSH
T14D11EF0955B13B35C3B1833685AB2311F333BE02F5F19FAE404A43466894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 18c7f53e318e20e4499223a17a5a330fa6198a3d8bcb6a121c2786319970fdf9
MD5 fbaa75d25d1123ef9755698309e1f1ca
SHA1 800c4d438914b8dc5c83b7f0341c7d475ac5ae04
SHA512 4021f10d6211126b8768d769be529fd1fa4689d4e7b42b0607275f9928103b7de00ef9e1319bc52a11f38981e07fe394fd54359f02e46aa3d917f4a5f278279e
TLSH
T17411EF0955B13B35C3B1837685AB2311F733BE02F5B19FAE404A4346A894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 128d304d7cd8685b9ddb9537cc8ed73f41b6f93b71276c75dbd76c0c04d683ba
MD5 58724cb5be5b3172a590587522fe4fc0
SHA1 ae2c31717c978aebcec42fc50992cc56be121a78
SHA512 4a4a58605b533268f2dcebac53d5e36fa636dc63e720fa5881e98f61b951ed8430815e879bb9fed92fe97b03c26ea8ed2469e4eca2c19d25b5be52f752bdc884
TLSH
T1EA31FE1556EA1B62F37BD734D1F62512E532BD91BA50AE4D0044524A0C72B827E84F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2c38eb46d878ab4906e2f166738b957c22c2866ea995f56d1fe1602fa6d1fe85
MD5 fe2a56c745e3a5813c6757f5904136ca
SHA1 0c32006d69197b089e390fdf0a793458f13e6b48
SHA512 c98ffcfbdb7498d6c622fffa2609ecdaf29b9f7861cc9d898c26a0b393c04b6e68d6e80d6df675b395005d8cd515aa9447e82e7545075b5797af098ee45c93e5
TLSH
T1DD11EF0965B13B35C3B1873695AB2311F333BE02F5F19FAE408A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8e0c05886e758cbe8d045653f6aa22bc10927cba6e37e32f1fc1515067193781
MD5 f7205972f37da36e1b388f03dae3cee9
SHA1 06df0c33c365e31032fea02c8d7f5e0b69e1cdd8
SHA512 6b730da3e4ceec14d086d0ba1edcae79c86830737e45bf217ec3d3d626ceda84d23d090e684497d7f54428b548ed04ac6a423e073a473a8a5ecc117c8cf5ef89
TLSH
T1F111EF0955B13B35C3B1833685AB2321F733BE02F5B19FAE404A4345A894241EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 575a86ca3e00028d0a7782284b94cc1b01caefe49b41988fc4ae1b811b90b456
MD5 4745de880ef0d3e490d7299c5f1f10f6
SHA1 9aa2bcdd0ae2ed2beb28cf8cd77db16dfbbd32a5
SHA512 60c30f164c0cab209998a53105c5e707e5a39dffccf5797742bf7ca76759d1a8c237d32e2da8bfc0a02d5b5ebfc6847f2c84bd9aaa80fde9c7db6c871511e6c1
TLSH
T1E131FE0556EA1B62F3BBD734D1F62513E532BD91BA50AE4D0044924A0872B827E84F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 29f9ba31ff3125debf15226fb1cdde0303fd161b6bca62291a8e3574ae7f8508
MD5 358513521c657d5ad2e0c878ccc13f69
SHA1 6396e4b9bf7b93339aaa434ffb740cdc9d9b9df6
SHA512 a0ca821c887fa68f3ac5c6bf2b9c688b8706a3c1fc8ffc8f4647cad8fd52065bfbdb3e6da8b61c97f75bf4e7c8369bc85afed72ccb811ab448a529c309703074
TLSH
T16311EF0965B13B35C3B1833685AB2311F333BE02F5B59FAE404A43466C94201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 71d63fef698c2ae97b4ed3d22990390c7d203cff6d16da8302599cdd8e0c77f8
MD5 096a286400887de6c9c84ea5e7dbf678
SHA1 bd10a0b4c75e5983d554b2759567cefa9ab9c1cd
SHA512 8cef66d76c905e00fd8929e1d601234385bcf972fbb00d2721c4c6a9339e5da574928238bd185a72a19e72c73843643c573915f8bfcbecff0483fe1ffa0b4879
TLSH
T1E411EF0955B13B35C3B1837695AB2311F333BE02F5F59FAE404A43456894201EE58FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c1ee94cb2ce65f314c58b92459aa297d74abf9d31c7cdf126f546e6e3343b030
MD5 65ba6e1684ca8c884a966014e5753849
SHA1 ee8018146e59676c3ed9ce9a4ddafd4420c9eaf0
SHA512 c4bc0129c05271002442b369aeb803cb1faf07f04f9699e07106b444702699fd59d0bf3f7dd2582923e573432e75e2b4c75fde56809987097371e5285cbe04f0
TLSH
T15D31FE0556EA1B62F37BD734D1F62512E532BDD1BA50AE4D0044524A0872B837E80F2E
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.2MB
SHA256 b506a32eab806775eb9d99e7a606085cc0aa07b1d3fab333ca1e87349269d13c
MD5 73d6ca6373098cdea8ea755c5ca56119
SHA1 e3fc607d6deae4948451ca96cc1ec2fa16d4c3c5
SHA512 1c5ba7fb4cbbed36882e2d7869b7a5f04cabcd3fbe4965a3c615bed9a73a94c73a68bac738d3a6a597acb9c8dec9388fbb71caac5a34f1624718aed242217e35
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCN:eEtl9mRda12sX7hKB8NIyXbacAfuKJU5
TLSH
T173E54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini
Size 3.2MB
SHA256 07c920d6dc68c9da61cff27b84f45008e93bfb9ca3123be3dfed1f0cfc770849
MD5 8fdc276e511c39aefc28492e804abe10
SHA1 5c2fd8597d49aa25f15fef884687f966c7c545c4
SHA512 3994b991b594086bf0048731983befb10d01b464fdc2f42738d53a4ac0cfb016b79709d2e02947020ac8790d02707798514a11adf753660a91f2ad96f1a053c6
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCZ:eEtl9mRda12sX7hKB8NIyXbacAfuKJUV
TLSH
T179E54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2172-45-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/2172-8-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/2376-59-0x00000000035F0000-0x000000000384F000-memory.dmp

Download

memory/3332-43-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/3332-42-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3332-0-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3332-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/3332-1-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/4920-54-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4920-44-0x0000000000400000-0x000000000047B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads