stihat | 1ec94f60aa3d2765eb74f4987fa1c855c8543d41e1e34b89e9a4d6602ca04a8e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
Size 3.2MB
Sample260728-v35bcasxew
SHA256 1ec94f60aa3d2765eb74f4987fa1c855c8543d41e1e34b89e9a4d6602ca04a8e
MD5 21ae9e17e4dee83859d47fc64210924a
SHA1 8bc2c1808f909224e98c7a86bcf81d5ac8fa88ef
SHA512 6d148c72148f0287ef4bd70a3bdfb8b5ea78333040673e898914cd482100ade455efd7b5d909922a2ce27aa1604084576dfe0189c3caf017d8efbe87a78f4932
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCx:eEtl9mRda12sX7hKB8NIyXbacAfuKJUt
TLSH
T10EE54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 10 IoCs

resource	yara_rule
behavioral2/memory/1856-0-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000b00000001b315-6.dat	family_stihat
behavioral2/memory/3160-8-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000c00000001c5d9-31.dat	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/memory/752-43-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/1856-42-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/752-45-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/3160-46-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/752-55-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/1856-0-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001b315-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3160-8-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d9-31.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002f-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/752-43-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1856-42-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/752-45-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3160-46-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/752-55-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
3160	HelpMe.exe
752	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\G:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\N:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\J:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\P:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\R:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\O:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\V:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\A:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\L:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Z:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\W:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\B:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\H:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\M:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\U:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Y:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\D:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\T:	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\AUTORUN.INF	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000bdac3cafad0fdd012d50803cb50fdd013997473fb50fdd0114000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3836	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3836	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3836	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3836	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 3160	1856	2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_21ae9e17e4dee83859d47fc64210924a_darkgate_elex_gcleaner_luca-stealer_necurs_njrat_rhadamanthys_ryuk.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3160

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:752

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:5316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.exe
Size 3.2MB
SHA256 331cc299d835a869a40024a940f7e014b2c7df546ea0936697bb2cc3bcf6979e
MD5 0f34f8d1f9f0af6e474aa581c294133f
SHA1 eb4dfc4c736bcfd4b59f98260ac18764dbcf7c59
SHA512 17c2d1f69ef58422bbefa22b038a6b5da0ad5b40d845670567efb84cc8e2bda6665aa7132f38cb67bb427d7e1c46ba4f9686b7dd083a926c61264298151d6422
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCh:eEtl9mRda12sX7hKB8NIyXbacAfuKJU1
TLSH
T167E54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4b0be4d8464ad3eea56c1d7f6f9565554f61c4f88d7fda1509d3d75ad0b8de16
MD5 aaf31a428c3b8f05356a1bd589325877
SHA1 fb9ad44f4e06803494466675bfda30fafadfae35
SHA512 42138f171d2a0737cf9e969473d13d7366e35add4a39a796cfc3fe3fb28ffc91bb0925108cd8db0fb9dfb04890821f76253af81f1b1c3921e6bcedafd58a0cb7
TLSH
T17A31121A49D61B22F277DB7485F25712D673BCD5A612FE1D408082091D21792BDD0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1d03abb4aebf55a496e8c6e32c339c1e8e7af3f6392a15e3a6feb9e847389672
MD5 492a77ea443d0377c5555fb0f78f7611
SHA1 f3dd354bf34fc524f59e6ac62a095cb99842e501
SHA512 05980bc659e3b95a2eb7d4f7c0486b9fae1bfb1ab03e5c3bbb0225b04e41e5302ac9eb63b47aedfb102fb783dc6caba7a98795ca809afab3af21b3d74b76772b
TLSH
T18811CE156A913B36C3F1863644A72322D7B3FD02F5B28FAE804506816E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 da1657470d41ccbd83ab9eea14a88eaa8973d48dbba8a429c0a084b9693ef4f1
MD5 340c5639a8e2abc3cfedc0d0189c0fa2
SHA1 7359747e552b33e38ed36bd2ac85bad0fa1e733b
SHA512 352c1c8e8de1bb2d487af6ebdd80da6bc3570157313593a4cffb1cbcb07917fd908e1771a225f5221e30f8de44ab2f830794a15cdbd0beee2d87efa62e0a6bff
TLSH
T1F011CE056A913B36C3F1863A44A72322D7B3FD02F5B28FAE804507806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 30f05bbebf407324b6c44e112c411eb35b07e1cb3a4f9960805b8f38c75e4a53
MD5 ef212ffae8c6cbd9b7c28ff308a40fc2
SHA1 4639d12943429a448dc19db15aabd67a1b601fd6
SHA512 bc058b146b931c33aba9111c8a9a760e09e9427d3023d7e532002ce08d96a94244d554e83c256b758315ab9834e0c8eb17363e6c32a617b27de877c81fea45bf
TLSH
T1D631121A5AD61B22F277DB7485F25722DA73BCD5A611FE1D408082091D21792BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 68a6b533a219e580a43676211b1f38804889828dbfef27d51b0d425553558167
MD5 5e54c1998f61c68d326df87308115d66
SHA1 326ef6ceee43cddcf0fb443bfd39e9e9cc4352e3
SHA512 9f218f8e9b5aea05b20caef595f1d1b90a9dc0918a437153fe7c5127251569c1f630b119835dade4491cf5490509b94441c9dc141139c2d94990db973fccbfe5
TLSH
T1ED11CE056A923B36C3F1863684A72322D7B3FD02F5A28FAE804506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 741b93f316973221e10dd88f497159acaf9362353b0894f34bf45390484119f4
MD5 124206b9a0da19d5f5767900d901fdac
SHA1 9ac0136f2e53fcf36d3d565eb0e7522eb54ec87c
SHA512 3dff7415642319353602a1a7f252d55a424a73e19a8d90cf169d7eda02c7e6d83584140865728f2a79494192b33c43c76968df5158957db1a83b92e4f914d043
TLSH
T1DC31121A59D61B22F277DB7485F25712D673BCD5A611FE1D408082091D21B92BDD0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7f485f873e280d89086ed05a0b958b28667845c5927dae2fefd71f5426a0cf82
MD5 fa4fa56289492cef85374b859167ff3c
SHA1 77fef988a1959fbf26973f499d0a01475c6b2aa0
SHA512 a3141c96fef6f53183329375cf07aae3173417a5793f3879e9378b22377334a69cb2a38e62919ec3abf4ee46fe7b90f9cfb9df8d7fe79d26baa9d802d5e47a3b
TLSH
T13F11CE156A953B36C3F1863644A72322D7B3FD02F5A28FAE804506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fab67d5c57c97da13f12e48c603f177172f5541b5d36cb1c7498f0865e6cd060
MD5 20516ad05b74d0e6f6a1be7b4e22bf2a
SHA1 e49d2ce03aef16fd60a599b8273a5fbced7f45af
SHA512 458adcd2c71b2e22f7e83c65a0372c094b53676bdb083ecc26bdf3a59f6a12b69c2ee5869ae357d479952e72c898368219c415a3a098eed2f32e7d16a7a32344
TLSH
T11811CE056A913B36C3F1863644A72322D7B3FD02F5A28FAE805947816E451119ED4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0269a2a43bbafd28a8f32b4d9413eb240f807f1071d57a4922ecc07d52e5e4e7
MD5 98896d9efb5077541f3a438d1b197c5f
SHA1 af9a29f0ee7be65ae4373a16f850ecb10cfb4237
SHA512 43b1c67154c238225fa5b349012d0b30fa0839409c3e4117d88559ccd567b7df1dfaf8035d0b54efbf099fd9cbfdb78e9136c44f2a1ab6b623c9b0c61cda9178
TLSH
T13E31241A5AD61B22F277DB7485F25712DA73BCD5B611FE1D408082091D31792BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 aa830a836a05f207b1b7891a7c5611c07a530eae240a1ee1603d36f53a6bda69
MD5 6880979e31300d5ae58847ddfe6d1bbe
SHA1 845a3b51ab32a6fe09a69b4ef76922929a14ef96
SHA512 0d430b0ba416293af797e107c728359990b45227c19637b8ac5519cde55bdfadcff9ce3297c6bbc22b5410b586b24599065ca1bf418e15f2cb35c1ef28b40903
TLSH
T19411CE056A913B36C3F1863644A72322D7B3FD02F5B28FAEC14506806E45111AEC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 37859aee0d1ba0178634f8355aa823a326c490711bc86f8a7b778b19cf8b6983
MD5 2cd250020b46219881335c286dd42a1a
SHA1 f5d4abbc95d2cf94cace78fe617abc878e10e8c4
SHA512 71bf222d7a2bede47f0698979028db562e1f65c026452a7b5450c9d5246fea7c6fb4c55ceb699d494619ccacffa56ff62f1f012f7bacc49e77fd7e4b7b2d358b
TLSH
T12B11CE056A953B36C3F1863A44A72322D7B3FD02F5A28FAEC04506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7d256928569d35d9a7b048e0ed5595a4d9d84214e029cbe6d39680b559f5365e
MD5 1dabb5684dabfd0c484afc2df9a794e4
SHA1 66fee5519298a94836c5e87fafa2eaf6aa89d011
SHA512 2c30c57cd124f10844f5890497a63d4f0e7f30f844fbf0fdbe70cd25dfac910ac05f2fad65a69adb3dee8529a3e5dc9ea94ca16d57deae432cc1a434473a5517
TLSH
T1D731541A49D61B22F27BDB7486F25712D677BCD5B611FE1D008082091C31792BDC0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b2943d9e92cc397b4f7bc083a9809c2d85aa8462e758af36000199f8989f1370
MD5 ba190c98467355a0030b4a9791d019de
SHA1 ddea99d2a044cc7fe55340294f2f1e9d4fc22fb3
SHA512 fbe3a44d5517f0831009dcc373a490274e88596fd62d1475ff54f87bc5a04bd64f743b91e2304e0b6ef76717d5ca3bb013147599a7136130711d29228dd3a1f5
TLSH
T12911CE056A913B36C3F1863A44A72722D7B3FD02F5A28FAE805506806E451119EC8F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 55a000a1a3506c703ee9f1df7febcbff0df750b5e24cc7ee00ee87922e21bfd6
MD5 b7da3d8e121fbefa2cefcc17b10d5753
SHA1 e5e3d8f6a7aa47dc6c3c1e688306e993f5434179
SHA512 e78d9db18eae88d0c33a4695c1114444bdbdeade920d8f187768bc8265b87d74139f53caa10faf9e0545b25913cbd7b8563574376935f3be3796161599e32219
TLSH
T18311CE15AA913B36C3F1863644A72322D7B3FD02F5A28FAE804507806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 98f2d17fbc0ff747751fcb8b6d8ead7d61d500ec67f16f5354f56b38ab27980b
MD5 c986a7dd5949ff57c23393199b274652
SHA1 cffff73f0d097cea3985058c08b4c26179057e6d
SHA512 ce56df4eaa8345834025c306a3e6b8c7bcea66079db3db268eff2d08e66a1a6f4557dd1129147799e2ae81f79aee3717ee01223d204530ce404d381695a899e5
TLSH
T14731241A49D61B22F277DB7485F25712D677BCD5B611FE1D408082091D31B92BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c6aa0f9d351957f3987f3246d576eb0d06b65be7113a8a1a146972d975bc7316
MD5 449f64ae35745758b917e04dba2cc339
SHA1 211c8f7c1d652dec32d595e8a4d826ecece08812
SHA512 7678bc14d4512590045fb100c219864e56d3e65d12c7bc5efb383dee4ee677a09dae46aeda35dea391762dbf2a53179177acc34729c017039fd15436ff9fd23b
TLSH
T1EC11CE056A953B36C3F1863644A72322D7B3FD02F5A28FAE804506806E452119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 957b5cabed0d9a11991f01dad5a237883c5a26c3d6c305051ef10f3670491ab5
MD5 e4fe1e860740a5889b9e779451c1d3c4
SHA1 7899815f414d00e457506768a63d60fc047c0570
SHA512 82c4262c907431417977f9528fe1c782e0cf320c44142f191f0f83cf3cb0c10249ca25340a3737429f007e5c4f3b7659d640e27fa3d31746c79c787e6bef6456
TLSH
T13111CE056A913B36C3F1863644A72322DBB3FD02F5A28FAE804506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4e8efc08ca9c3cb136e2dbee37615d48076540d3fe019d31a04e5794aabd07ba
MD5 36fa5afa22658b84f2c91b7d89d7516a
SHA1 0efb4354ce3a3c286d8d1330b52e64a151f7f78b
SHA512 07febf26f1f5debd5d657e756de049681e7915cf5907a76d507fd21fc5fd4ea052efbbd9b04501c758c1cf8baa8c2d7ffa82f69466474c189f9d4b813dfc8c2f
TLSH
T15531241A49D61B22F277DB7485F25712D677BCD5B612FE1D408082091D31792BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 196650b9aabbe916ff51971ed9e9316d9532b410152f1eff027fbaef50284a92
MD5 d46c3aaeedfe0d49399101acf217d560
SHA1 8af2a5329ffb99e8bb4fa4c66025a95da7279d4d
SHA512 24e77bf6ee3b56c51fd0c5c0bdfb1db0b0b85437db85b7fd08b95776ec82a27a31b439f7e5a594f7c656e0094a73f7d28119e53b856df481bc1837e3d661fd4d
TLSH
T1C211CE056A913B36C3F1863644A72722D7B3FD02F5A28FAE804506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 57ff6b0ea92160b2fda5c50ac611aff5dc65e417746fcaf810bcfbb31823bfd2
MD5 bf325afc5629d7c4333c54e986e2d7fd
SHA1 5278db697befd7f80f74613c9d7ea3415b18ec13
SHA512 df512c7bbc682af76d91c35a1df370dcb88561e0690803c252d0ad3accb832377ed5117054becfa6db2ac8b30b8b1a6924b0aca6e12fc0c0a3ffb22f5ed6e4f4
TLSH
T14611CE156A913B36C3F1863A44A72322D7B3FD02F5A28FAE804546806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 756bb1f2fcc6d188eeb1c3c2f09a25d7d49d2ff5392ce1f3ee0a78d9b2e8b05a
MD5 2c265a11a7f1be32fc781fca8e015512
SHA1 21e6a10f461a691b149b28b8ff4d06db9902df08
SHA512 9d9bff92b053dd77afb427a76280e1bd8421399093c31c8faa1c39c1aa4eac6180e50b24f8b0f47e7640ba6a5b8c81293d8b57909325ada3d317de23ba5a5ed5
TLSH
T16931241A49D61B22F277DB7485F25712DA73BCD5B611FE1D408082091D31792BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 18dda92e2078d8723cd4065d657e541f009dd8ba28bc7e118c01f13756417803
MD5 791355ce92646575be379d92af60297f
SHA1 16e5a841932fee8128536f4f2d4939348d408336
SHA512 9175767204b205fed37c3d922c9a641b5b6f2cc78ffbbb1a53ea187afc8afe0ef446838dce7d9ee56f104626f96fe9663b1758bff8ac87578ba44f44b788b149
TLSH
T14C11CE056A953B36C3F1D63644A72722D7B3FD02F5A28FAE804506806E452119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 74ff22f26074f9e0069ae808b899bd46000ef200fc1d52c4acd219f94052c276
MD5 c1f05939f05caf674b47aff79072ff5b
SHA1 9b78450632bcd250be8056aaa50e2f7306034bbd
SHA512 ccfe92f1b5269753b54d6b3818804d8eac0ac9d081ff8b5cc5b121ddefc61aeacbf643f7164e5ca19a3f52c3ce9deaf7cddf01ac604eb9db7e91c0fa3b77c3bf
TLSH
T17931241A49D61B22F277DB7486F25712D673BCD5B611FE1D408082091D31792BDD0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 12805c617a28cb9d8d27cf88db70939b70891d0a1e83f266ae7c66e0eba79fd6
MD5 3903c4e70145a517d1501bb6dbb79dde
SHA1 42950d50a908658a1d5f2877fc3433e0b987a510
SHA512 565a850fc869200fdd889e2d62364e0acb06b952922d18f49214809ea905870a18d96f8472db6ca90a52b913b18beda6d26b9e3fb2da6d2ec644152138159c5b
TLSH
T11611CE056A953B36C3F1863644B72322D7B3FD02F5A28FAE804506806E45121AEC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 8972b491fed5d7f801d71d5ba650ddd792eafde39c8a9a51ecb45757b93c0d1f
MD5 7830d871c85488512dd45717818646e4
SHA1 ed85a71d9ed4454bcc4ce193360facb07839da28
SHA512 23ab2bc596bcd75b57c9cb341bfeeaeb1dbb9725d9a87092196b7541e5945aad0f9cbd76808ff00e50fd6fe6ca51f820a01e18ee74bad8e0bed81a6e22d49405
TLSH
T1FB11CE056A913B36C3F1863644A72322D7B3FD02F5A28FAE804546806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b0836b801d029218b94826cab3854f44a6c48eddb89fdb1908e2d60d090f9877
MD5 7fbd4d5ef62512408db5107935fe49ce
SHA1 8d98aea5658d4169d0b730310041ca66cc86a5e8
SHA512 766ccafe08e6ad467a6dcdbcbab4848beb1eeb7f5b56102843ddd4b15f1604fec6f5992d45f582fc104a04fdc21071a9a6a75d9680e8103336e603d183148db7
TLSH
T13C31121A49D61B22F277DB7485F25712D677BCD5A611FE1D408082091D21B92BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a3eca35a0da526813f65a4edf2f53e388f34bee25d7f9484570203cde6783469
MD5 139a1d8420f3365f800d43f9448b0845
SHA1 17480eff99b68d50f4c8fedeee7c92a6b99bc579
SHA512 84cb2bab1029811afb4c56ebdd9b6bb1ca5807cfc667480a78900e50359a5bbc63782fa31db21aa3ee9640d93b8b8ebe159fb0e7aa8437a9f836bd3a59a2c0f9
TLSH
T15D11CE05AA913B36C3F1863644A72322D7B3FD02F5A28FAE814506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 46b0f5e3c7f8e87d13b486a4f9fa126e4e6db6043d3570e483794040b7441e6e
MD5 5ea39263ee5d926dd02f9b12712cd98c
SHA1 5600556504047198a2f8cf8af0de7a61b2b050a1
SHA512 5da0d028c3ecf3c4b9f40b7010327e541d0ae7aec7c745427e1b66f19a19319494ee53921480a418c3591c4ad72378b55b630767330d26c189155234f391f9fa
TLSH
T12D31241A49D61B22F277DB7495F25712D673BCD5B611FE1D408082091D31792BDD0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c76f995b26c5961e2ed9217adb0f54e6db5e4a592fa325f231f3d079be812849
MD5 1f4dbb0ec51d4aba867af1433f1f71af
SHA1 2a30b4d074c6fee4609b784d0cb91ab235dd101e
SHA512 3162d5bebab11c70886e8d63920c57a0f778e8d8a0adff6b4d1bed29b6b475be4e3230d19d36c47549b6abbc6de3e74e7528dfc416fc9002bb154636e5b83ea1
TLSH
T19211CE056A913B36C3F1963644A72322D7B3FD02F5A28FAE804906806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 de627f2bf9b796e9d283a1c94ab72d7f7f1e99bafb48430863e308dc328bff1c
MD5 5cb2625b5a61e8b8d2043ebb1bcb0bf3
SHA1 2f6a1b2525d37036f4a2ba09563c4d7be00e3b39
SHA512 e8fbff2438dcaf373f9b6020d00511ab1f3396491859784077570d158231b4bfb00373a04b19e120a8fdd883cd3c146eb08da26bd250260841f78d1a8b789d0c
TLSH
T1E811CE156A913B3AC3F1863644A72322D7B3FD02F5A28FAE804906806E45111AEC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 56310107afa19fc72782f0d13fd7699fc8136129731260a4fd45f62d564cb98b
MD5 665fcbb9f450feeeef0f3417e34b76ed
SHA1 a09c5f68df0a48c16a58777b76f2d53eab614c56
SHA512 05ca58f04ac646f254fd5d9b5b006cb752f00e569c4f34030f31a1d026e6dc56b8ff2e85f2a584a81d8470a749f24f896ce7f7554a94ebddec2e4ed988db6dde
TLSH
T11E31241A59D61B22F277DB7485F25712D673BCD5B611FE1D408082091D31792BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 02d658a160818388b66e971a6c6f2222528b9d1eb45addd83d1a31117d410397
MD5 a1597a6525e4d8b7f7abd6fe3659dd55
SHA1 8a3996adf8e3af836462b723e9af1f7a5585d646
SHA512 9ec9701ef8e2c04fe177a6ad2ebb5f40144abd007caef6e79f9da0a8243324ee7456d0e85aab07a28b2cfb37493210f44379677552268a264d3e97a996317e3a
TLSH
T1EA11CE056A913B36C3F1963644A72322DBB3FD02F5A28FAE804906806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 25839ab37ff3f63af6529ab19c75f2c8e9533d854601577288db88a6e336fe6a
MD5 44da608566ddf8ba3254fc69b7064ce4
SHA1 ceefc998fe7868ed2ed7fcf3ea1c0f20108ac44d
SHA512 348481f0f1a9f6415e5ced65baccb0b287ba12bf7211eb06032463381fe42c51d9245108107db8a6c3b5e23046d58a3e5d8d7bb1aceaf736d7b464b8c275fa5f
TLSH
T1E411CE056A913B36C3F1863644A72322D7B3FD02F5A28FAE804506816E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 c52dd089982c1db47ca7a4509e2c922f6c5517852e748eb9c8c1dd84a58fb91a
MD5 b2d187027f33d83430e47a24908eb6ce
SHA1 a4730ec8a9af8daee8376318d67da35a8b9dac21
SHA512 9205672a96c29dfe16c579be5db535bac421b8f4fc1932ac3c97365e369e12bd1fcac0515c6f47f303d2f4de681a983d63b068b5e15a8f3c65d0d3d8b47dc330
TLSH
T17911CE056A913B36C3F1863A44A72722D7B3FD02F5A28FAE804906806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7f9b0353fc37b0cfca64d669955d3d28b892629c1bd01a3f996f8e675195eda6
MD5 95b636c1ffcc50992c3c8df3bbecfc92
SHA1 c0d0b03f3aebf0378176d515d4ea599f8969fc7d
SHA512 c98888073feb2838bc5c052bbe427983e2082fe3639bc1c5b93759d79a1139ea82b80a5e2f92e1abca00c747e949b2fbcf7cf6ba69fdc6d85293bae58cfab883
TLSH
T12331241A89D61B22F27BDB7496F25712D673BCD5B612FE1D408082091D31792BDD0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 35ac8045c25e718bdcc9ab1a7cdc9f38bd8f98cb053266f5ea207ccdabf858e4
MD5 90418f96d183764716392d46660fc3a1
SHA1 b2d5644cf5a53dab5510ec3786e4e37702495864
SHA512 d72b6c4696e4fe13aadb39d88f0d3e1bcf54a9e0bac86e8c9ba0ddf6103eb86e5c4b0acf746ce4b7730e63fddfabcfa3c574fb0af39bd0d651a847f38fcc049f
TLSH
T1A911CE056A913B36C3F1863644A72322D7B3FD02F5A28FAEC04506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 15cdd4df7fb6738e515de1f59db857e88df241a12874d00603b6f0ac12baabc0
MD5 83b1216aad277e87d1397fba4fb0eb24
SHA1 0c70c555cff813b4cd094a65928304287e31c4c3
SHA512 3d89a83df248f683e16eb33a31eaf0d35c41e2bb81196b2b56a9b59625d5215feb69a2bb96c59fab47fa36fa07933ae63b56fddf5bfc6d58e254d6b5c8802e83
TLSH
T17631241A59D61B22F277DB7485F25722D673BCD5B612FE1D408082091D31792BDD0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2b786a882e07d4cde7915971e0c58794c5030a06c77ebd319429406fbf5c21fa
MD5 983169433d510376474f55ce08abbc7a
SHA1 3f0c1af712e912be3de0dbe8f047b8d46e843112
SHA512 db93060f64656532c0f0e787d135a10bed12417bc01c804f1b92c074290cccd8ff6626239cbea84bf1dbb8a34d96bfb6c8f8c4a6e0f1f8955447ae33cc89a58f
TLSH
T18511CE056A913B36C3F1863644A72322DBB3FD02F5A28FAE814507806E45211AEC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 0f391f0e5658d519cdf6f8531f363a33a79ecd1d4bc53925d4a04dffa32630ce
MD5 d98003735da29f6b4c123709f75ced31
SHA1 199aaa01886b5fe16450b3251a6519fd0872ed96
SHA512 c8720cb830265f27d7b6f2f9cb226b4c34a1455f826d01c4f5f786435b8dce8744ba73648ceb02f6272ab2b73b20673e976929c5fef8b4259224250d4a1a56af
TLSH
T1C811CE056A913B36C3F1863644A72322DBB3FD02F5A28FAE804506806E452119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1a8d5b7144081d1550e1a05757c8452707f0baa75a42ad0d34b59e02e3d9e2de
MD5 fd18dd9d14d0a667d2fc6cdf8f31a102
SHA1 dc15f6b28da90d4820dd51165a100e89e66ece8b
SHA512 93615c359bf4e9f089ad901e2ffa17fccbf33cc664bdd3afa5302d1e461e92b48a5cfe7bb96ef74ae13316ca4fbdc578924aca41e6212be05204d21ce2bd0ab0
TLSH
T16111CE056A913B36C3F1863644A72322DBB3FD02F5A28FAE804507806E451219EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e2837220afa2119c422f68acda91de90a54e10acb50c80a27e16f4cbdafc598f
MD5 b3db95efc3fed5f1cf24af9de6180f48
SHA1 fe8cdd41826ece774ef935047db0ecb96c5dd23e
SHA512 780cbe8e49a3e976e57a66d771bcd8a9e666228e3a0af33bb038d7ce3f6a8822b0e03dab8e36156ff3037105528ecf3c31fcabc49e641eb47b4d57f5b68f9550
TLSH
T1CF11CE056A913B36C3F1863684A72322D7B3FD02F5A28FAEC04506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fa3b9ec8cd03be47301ad02adf5098d17f96229bcde6552bb44aad54b7f9f25f
MD5 c14543d03559d94240243e6ad299962c
SHA1 dd8008914bb6322c316e17d5f8172c76fb1d48e5
SHA512 f249b5138fca49a6c68ba993c2c9a2b5e0dc14bd1f466d6f4d15edd5697d8ddae776d38317a9212dd5bed348bf6128ef8573f46e721d27e6d83ed77a9d183d3a
TLSH
T1D811CE056A913B36C3F1863644A72322DBB3FD02F5A28FAEC04646806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 edcf1db8845f44c7cbde6a658a329ca87ad3ffdc9d667934ce63d10127b320b5
MD5 5447822580fa728e7ca2e673a17c0453
SHA1 b62606e59c2d2c87dd5a5a72a00b0fa74642b868
SHA512 3df75e55da211e642f932f727fce3d4e17c2a2cdfe4bd2d081ce72775293b0f3d7f14baf67487d0c3179a300865434503ba877acd0dc0a3d4436e19d41d60e95
TLSH
T1A211CE156A913B36C3F1863644A72322D7B3FD02F5A28FAE804506806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 aeee5f2b6537ec0fa1e519408a21516ad80cbd967ff54ade9765abd9ff986296
MD5 43043309f5cc68c1bbb731efe8cd5e13
SHA1 cd83de406a8fae3dcad591977e731ec188bfe2fd
SHA512 fd429cf9220ab690fe538531286907d8caa9097373734add411ba981589f6f377a533ff73281fffbe9276208ec4510617dba870dca0a3b3b27c90380b73be5d9
TLSH
T1B631542A49D61B22F277DB7485F25722C673BCD5B612FE1D008082091C31792BDC0F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2e04f7a9f20b9124edb7ad2341a5bb68348e7d1a6115ca564753a983a4e41dd4
MD5 ee8c9f3584a3915be5bd0fa85c393bb0
SHA1 ebb013541cf26c023e6b535e740746a981d2eb7e
SHA512 b1d517ed4af57d3179547f8c02b53cf5b6dc16fa1fd96995eb7096e30b83cbe6e18d9ce004e6337a4cde4446c421987539df5cbdf3f3b2eff027313aeecf7da4
TLSH
T1F811CE056A913B36C3F1863644A72722D7B3FD02F5B28FAE804506816E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 545c711bf222f6fd67a59751f0d147cfa5ea15f061daf166a2d459b032b8d895
MD5 9984c467a4eea8f8c8edea7eb306f5e1
SHA1 44dc24c4c98a0cf38f41cec300bcdccd5bb7abbd
SHA512 653fbf674e6c0e095de832403b3f3b1997a230903cc3465ce8e602fd81ae650c517280335803f3bb35c9e58afb871164902391fce58c0770a898cbd8012e8752
TLSH
T10531121A49D61B23F277DB7485F25712D673BCD5A611FE1D408082091D21792BDD1F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 181ef86199050945750e72df3353c2b2734451f5bb870fc1a1fc1cf646acb27b
MD5 9ff2e1cae6424ec9fcd286aabe496757
SHA1 5c41329ecc50dc431f0785e23170a920fcbc327c
SHA512 4e07e97cc4fb8f214c5ef8278f5fc9d218ca8746f4645303920a8e5748602c7127b99921b2d434fcfcfc12b50af91080dfeb5bc76f0e6912814cfd0969f92a40
TLSH
T1B311CE056A953B36C3F1863684A72322D7B3FD02F5A28FAE804A06806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fc528fac59fb12c016806d3597da6c35fd1f12a6fa415d5562a91e4d3ec2f86e
MD5 89a7d4ea18752553480489e11da2c931
SHA1 4e7beff13890331b69b61fbc2819e9107b8bd799
SHA512 6437768d6f576df4a88e753cac9a5731c887c9d8b64202915f2ada377b4c9720d652576692b7163e9e1bb43ae518f316d7f56cc745b514e9005440927e7e8143
TLSH
T1FA11CE056A913B36C3F1963A44A72322D7B3FD02F5A28FAE804507816E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6ec0ca458852c37d5bbd07b9b3b4542255551d105e8b06b1a63695d6cd11dd20
MD5 47cf44a54f54d34621071a09f2532350
SHA1 b6d517aa4b5f46b49f1cb3b97044c3eebcc15fc4
SHA512 1d85137ae9c9a723835b3e9c8e81d57a57851506e7e1c0e6eb76c71e2a9873ab5511fe32c091e920c84a892456a7be2726731a43eea7d26c1785a8478094b0ac
TLSH
T1CD31242A59D61B22F277DB7485F25712D673BCD5B611FE1D408082091D31792BDD0F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2876bf9c866734d800d1876d33ec8bef18f75015aec3382b49bfdd11a7c00708
MD5 5a80940039261180ea3c01796aacb242
SHA1 723ea5f7ffd2aa0153c98bef606461246140f87e
SHA512 8c354f486ee3b5a123902cb305d288f9a4f017bd0e1ac72455c20d3aa22dcfa32397282a05f342e2cb5e486f0147b705e194720907531e15648d42b6405f3dcf
TLSH
T1B111CE156A913B36C3F1963684A72322D7B3FD02F5B28FAE804906806E45111DEC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e0a8f596fed42e3332f8a584f3c58acb8ffa55379a1797bd2f282c4c0395eb78
MD5 41bb6f17bd908ae3216c3ffc1eaded9a
SHA1 b05130cbdf7f18659a2546fa0f7730881a126b4f
SHA512 fdeaea8321fdb1a1436a3be09b2afe7b77380beb53cdbd07a770449915d71c39d95653ad5f9416728f4242dcbbff8c255ffcc9da879f79e16637fc9a33bf05c8
TLSH
T12611CE056A913B36C3F1863684A72722DBB3FD02F5A28FAE804546806E451119EC4F7F
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 3.2MB
SHA256 d0771be18b0c9df5e5d1c64e3e98befba73a79bfdfb771c884e7e7cd4f037f1a
MD5 9b0f13a246f8055584a9bc8ec85977ab
SHA1 fff4e60b0076f244603c9b8a911c82945651a791
SHA512 44368efd07e6476a3b7bba09907f77ee730c79eed87491b1e74964adaa1a67729d7f1e1d8829c13fa77728a3d5bd61b52f7adb8ddb0d87a1f2a63af2fb5913a6
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCf:eEtl9mRda12sX7hKB8NIyXbacAfuKJUT
TLSH
T149E54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini
Size 3.2MB
SHA256 6f781893c33b690941f4f0241f5fb687c59f245184247c914296e54e0be7ac05
MD5 6d9a158e34390004cbd73b8fca78f7fe
SHA1 2d563fe41442a7efafdc9684fcaf1fe781aa0202
SHA512 d21fdf7595a9b4ad1a7bff32f08ad5c24f796bef192e6858fdcfb5f9ee5a4dd06354ae04ab6aafeb64c566e9c96252b0baa95a8f53dd1e5757a99179bf64d0d0
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCB:eEtl9mRda12sX7hKB8NIyXbacAfuKJU1
TLSH
T1DBE54A51A3E5D439F2F7BE7868797B280CF57C125EB1AA4D5048A71C0EB0EB0D8B1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-45-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/752-43-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/752-55-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1856-44-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/1856-42-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1856-0-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1856-1-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/1856-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/3160-46-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3160-8-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3836-60-0x000000000CFC0000-0x000000000D2E7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads