Overview

overview

8

Static

static

3

Fix/IDMan.exe

windows10-2004-x64

7

Fix/IDMan.exe

windows11-ltsc_2024-x64

7

Join Teleg...re.url

windows10-2004-x64

1

Join Teleg...re.url

windows11-ltsc_2024-x64

1

idman642build64.exe

windows10-2004-x64

6

idman642build64.exe

windows11-ltsc_2024-x64

8

idman642build64f.exe

windows10-2004-x64

8

idman642build64f.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    37s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    idman642build64.exe
  • Size 11.9MB
  • Sample260809-rafkqsygla
  • SHA256 2613854939069bf9338e79dd8dd94ed2ff4258e3aa0e768fc0ca904f2f094edd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\idman642build64.exe
    "C:\Users\Admin\AppData\Local\Temp\idman642build64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
      "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
      2⤵
      • Installs/modifies Browser Helper Object
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2600
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          PID:3532
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4484
      • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
        "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:3416
      • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
        "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4012
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4132
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
              PID:3492
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4448
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              5⤵
                PID:4708
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3268
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
                5⤵
                  PID:4800
              • C:\Windows\SysWOW64\regsvr32.exe
                regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:672
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
                  5⤵
                    PID:4956
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                  4⤵
                    PID:1544
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                      5⤵
                        PID:3892
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {0be77314-42e5-4f62-ac16-db75cc5dbb50} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                          6⤵
                            PID:1200
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {e817fde6-3da1-4789-91e5-e484ec760109} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                            6⤵
                              PID:4300
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 25164 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {3bbf7341-326c-4749-a035-fad9ae8ed3f6} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                              6⤵
                                PID:3932
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4092 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {270e3039-a688-428e-ae84-bc017471d16a} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                6⤵
                                  PID:1444
                            • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                              "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                              4⤵
                                PID:2992
                                • C:\Windows\system32\RUNDLL32.EXE
                                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                                  5⤵
                                    PID:4288
                                    • C:\Windows\system32\runonce.exe
                                      "C:\Windows\system32\runonce.exe" -r
                                      6⤵
                                        PID:2536
                                        • C:\Windows\System32\grpconv.exe
                                          "C:\Windows\System32\grpconv.exe" -o
                                          7⤵
                                            PID:2488
                                      • C:\Windows\SysWOW64\net.exe
                                        "C:\Windows\System32\net.exe" start IDMWFP
                                        5⤵
                                          PID:4352
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                  1⤵
                                    PID:1940
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{80ce0cdc-9b35-7c48-aa5d-03c805c23f78}\idmwfp.inf" "9" "4fc2928b3" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Internet Download Manager"
                                      2⤵
                                        PID:3960
                                      • C:\Windows\system32\DrvInst.exe
                                        DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000160" "WinSta0\Default"
                                        2⤵
                                          PID:3704

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            IDMGetAll.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                                            • Size 73KB
                                            • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMGetAll64.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                                            • Size 93KB
                                            • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMIECC.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                                            • Size 463KB
                                            • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMIECC64.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                                            • Size 656KB
                                            • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMNetMon64.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                                            • Size 555KB
                                            • SHA256 c08ff1c6ffa6242f693ffe98dad40425a0770e78e774265e5038117a8fcd54a4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMShellExt64.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                                            • Size 36KB
                                            • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMan.exe
                                            • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                            • Size 5.8MB
                                            • SHA256 032118fc1bad5571a53556b5eedd01025de072adbd0b8b6325ad7b71cfc11872
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            downlWithIDM.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                                            • Size 197KB
                                            • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            downlWithIDM64.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                                            • Size 155KB
                                            • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            idmBroker.exe
                                            • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                                            • Size 153KB
                                            • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            idmfsa.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                                            • Size 90KB
                                            • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            idmvs.dll
                                            • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                                            • Size 20KB
                                            • SHA256 a2e28177b51a556742a164955f8b62dcf2bdf848c2f6907fea0c92ee8e4ccddd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDM1.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                                            • Size 163KB
                                            • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            IDMSetup2.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                            • Size 4KB
                                            • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            idmwfp64.sys
                                            • Path C:\Users\Admin\AppData\Local\Temp\{80CE0~1\idmwfp64.sys
                                            • Size 169KB
                                            • SHA256 753a1386e7b37ee313db908183afe7238f1a2aec5e6c1e59e9c11d471b6aaa8d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            idmwfp.inf
                                            • Path C:\Users\Admin\AppData\Local\Temp\{80ce0cdc-9b35-7c48-aa5d-03c805c23f78}\idmwfp.inf
                                            • Size 2KB
                                            • SHA256 a54e0ac05254a464180e30f21a6b26651e7495427353bba9c246ba1d2388e7cc
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            SETD79F.tmp
                                            • Path C:\Windows\System32\DriverStore\Temp\{fdb5b4fc-575d-0343-955d-f1102e7cbd74}\SETD79F.tmp
                                            • Size 12KB
                                            • SHA256 52818c67be219bc3b05c58b40e51b99a65c2f4bcafe38a995610b4ec10928def
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/2972-439-0x0000000000400000-0x000000000042B000-memory.dmp
                                            Download

                                            memory/2972-1-0x0000000000400000-0x000000000042B000-memory.dmp
                                            Download

                                            memory/2992-488-0x0000000000400000-0x000000000042B000-memory.dmp
                                            Download