xred | 09de73c4a13eb11c023a458c9e7d459feaf36935642a6df4a15787a04683d9d1

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Size 13.3MB
Sample260819-ndlpdaee87
SHA256 09de73c4a13eb11c023a458c9e7d459feaf36935642a6df4a15787a04683d9d1
MD5 88435bc2477695ebe4c92fbf5401227b
SHA1 9e20aee95e3b7b0e8bb46e090bfdb0d122cee45d
SHA512 349c336b4f09c17d6d6a165ec5e58ef8bdbc1a0d9ef18f104c415152132900e8d37687080632b6ad6373844fe22e387f383f29f66451ac9d0a1ace2750779e57
SSDEEP 196608:aLqjpRVd20orj1kDIboDvEtuW9XzuaAdxEdqbLDGn7xK0sWsP9SN0Eo:auzmjuDJDvk6xdxEkben7sw1o
TLSH
T11FE6223072919132FDB206359D7E8275C8297EA12B34A5CBF3F439499AF6DC1692036F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 6 IoCs

pid	Process
5088	._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
4672	Synaptics.exe
4024	Synaptics.exe
3156	._cache_Synaptics.exe
3640	._cache_Synaptics.exe
2624	t2w_install.exe

Loads dropped DLL 1 IoCs

pid	Process
3976	javaw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2w_install.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4924	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3100	wmic.exe
Token: SeSecurityPrivilege	3100	wmic.exe
Token: SeTakeOwnershipPrivilege	3100	wmic.exe
Token: SeLoadDriverPrivilege	3100	wmic.exe
Token: SeSystemProfilePrivilege	3100	wmic.exe
Token: SeSystemtimePrivilege	3100	wmic.exe
Token: SeProfSingleProcessPrivilege	3100	wmic.exe
Token: SeIncBasePriorityPrivilege	3100	wmic.exe
Token: SeCreatePagefilePrivilege	3100	wmic.exe
Token: SeBackupPrivilege	3100	wmic.exe
Token: SeRestorePrivilege	3100	wmic.exe
Token: SeShutdownPrivilege	3100	wmic.exe
Token: SeDebugPrivilege	3100	wmic.exe
Token: SeSystemEnvironmentPrivilege	3100	wmic.exe
Token: SeRemoteShutdownPrivilege	3100	wmic.exe
Token: SeUndockPrivilege	3100	wmic.exe
Token: SeManageVolumePrivilege	3100	wmic.exe
Token: 33	3100	wmic.exe
Token: 34	3100	wmic.exe
Token: 35	3100	wmic.exe
Token: 36	3100	wmic.exe
Token: SeIncreaseQuotaPrivilege	3100	wmic.exe
Token: SeSecurityPrivilege	3100	wmic.exe
Token: SeTakeOwnershipPrivilege	3100	wmic.exe
Token: SeLoadDriverPrivilege	3100	wmic.exe
Token: SeSystemProfilePrivilege	3100	wmic.exe
Token: SeSystemtimePrivilege	3100	wmic.exe
Token: SeProfSingleProcessPrivilege	3100	wmic.exe
Token: SeIncBasePriorityPrivilege	3100	wmic.exe
Token: SeCreatePagefilePrivilege	3100	wmic.exe
Token: SeBackupPrivilege	3100	wmic.exe
Token: SeRestorePrivilege	3100	wmic.exe
Token: SeShutdownPrivilege	3100	wmic.exe
Token: SeDebugPrivilege	3100	wmic.exe
Token: SeSystemEnvironmentPrivilege	3100	wmic.exe
Token: SeRemoteShutdownPrivilege	3100	wmic.exe
Token: SeUndockPrivilege	3100	wmic.exe
Token: SeManageVolumePrivilege	3100	wmic.exe
Token: 33	3100	wmic.exe
Token: 34	3100	wmic.exe
Token: 35	3100	wmic.exe
Token: 36	3100	wmic.exe
Token: SeIncreaseQuotaPrivilege	2260	wmic.exe
Token: SeSecurityPrivilege	2260	wmic.exe
Token: SeTakeOwnershipPrivilege	2260	wmic.exe
Token: SeLoadDriverPrivilege	2260	wmic.exe
Token: SeSystemProfilePrivilege	2260	wmic.exe
Token: SeSystemtimePrivilege	2260	wmic.exe
Token: SeProfSingleProcessPrivilege	2260	wmic.exe
Token: SeIncBasePriorityPrivilege	2260	wmic.exe
Token: SeCreatePagefilePrivilege	2260	wmic.exe
Token: SeBackupPrivilege	2260	wmic.exe
Token: SeRestorePrivilege	2260	wmic.exe
Token: SeShutdownPrivilege	2260	wmic.exe
Token: SeDebugPrivilege	2260	wmic.exe
Token: SeSystemEnvironmentPrivilege	2260	wmic.exe
Token: SeRemoteShutdownPrivilege	2260	wmic.exe
Token: SeUndockPrivilege	2260	wmic.exe
Token: SeManageVolumePrivilege	2260	wmic.exe
Token: 33	2260	wmic.exe
Token: 34	2260	wmic.exe
Token: 35	2260	wmic.exe
Token: 36	2260	wmic.exe
Token: SeIncreaseQuotaPrivilege	2260	wmic.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3976	javaw.exe
3976	javaw.exe
4924	EXCEL.EXE
4924	EXCEL.EXE
4924	EXCEL.EXE
4924	EXCEL.EXE
4924	EXCEL.EXE
4924	EXCEL.EXE
4924	EXCEL.EXE
4924	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 5088	4572	2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe	86
PID 4572 wrote to memory of 4672	4572	2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe	88
PID 4672 wrote to memory of 3156	4672	Synaptics.exe	90
PID 4024 wrote to memory of 3640	4024	Synaptics.exe	91
PID 5088 wrote to memory of 2624	5088	._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe	92
PID 2624 wrote to memory of 3976	2624	t2w_install.exe	93
PID 3976 wrote to memory of 3100	3976	javaw.exe	94
PID 3976 wrote to memory of 2260	3976	javaw.exe	97
PID 3976 wrote to memory of 1124	3976	javaw.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\t2w_install.exe
    C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\t2w_install.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms16777216 -Xmx50331648 -classpath "C:\Users\Admin\AppData\Local\Temp\I1787138222\InstallerData\IAClasses.zip;C:\Users\Admin\AppData\Local\Temp\I1787138222\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787138222\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787138222\InstallerData;C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\InstallerData;" com.zerog.lax.LAX "C:/Users/Admin/AppData/Local/Temp/I1787138222/Windows/t2w_install.lax" "C:/Users/Admin/AppData/Local/Temp/lax8095.tmp"
      4⤵
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get version
        5⤵
        
        PID:1124
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3156

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3640

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 13.3MB
SHA256 09de73c4a13eb11c023a458c9e7d459feaf36935642a6df4a15787a04683d9d1
MD5 88435bc2477695ebe4c92fbf5401227b
SHA1 9e20aee95e3b7b0e8bb46e090bfdb0d122cee45d
SHA512 349c336b4f09c17d6d6a165ec5e58ef8bdbc1a0d9ef18f104c415152132900e8d37687080632b6ad6373844fe22e387f383f29f66451ac9d0a1ace2750779e57
SSDEEP 196608:aLqjpRVd20orj1kDIboDvEtuW9XzuaAdxEdqbLDGn7xK0sWsP9SN0Eo:auzmjuDJDvk6xdxEkben7sw1o
TLSH
T11FE6223072919132FDB206359D7E8275C8297EA12B34A5CBF3F439499AF6DC1692036F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_88435bc2477695ebe4c92fbf5401227b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Size 12.6MB
SHA256 e145210636e3598206cb60d47195ed90d486a40770299a7c4dfbf7378a9a37f4
MD5 adbd25a6e65ac85cf392388ee2f762f6
SHA1 b70f649e14011952f41339cfa3d8a9e33553a2d0
SHA512 8006b22fda88976363d9b4423498334e465d156be5a7c19e602f53f75c5535eb56365285b77af598ace1ea1a92cd9e1206364c6949c666ddf3766213531e5f8e
SSDEEP 196608:vjpRVd20orj1kDIboDvEtuW9XzuaAdxEdqbLDGn7xK0sWsP9SN0Ef:7zmjuDJDvk6xdxEkben7sw1f
TLSH
T1B6D623302651A122FDF24231997D8232C969BEF25B7095DBF3F4758999F2CC19A3072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83A85E00

Path C:\Users\Admin\AppData\Local\Temp\83A85E00
Size 22KB
SHA256 47b021d01fdbc0f93ce7c437df0af267038784ae0f4b72eeb2b62af84fa56f10
MD5 425e91b02f033ccc65d0db2eecdf7b83
SHA1 a688d6aa967243ed904a4652c035777efd3e711c
SHA512 bfaf8126571dc404a482cbc1c039079480e51da728994bad57f8b33165c6bef6da212e356f05b6730ce048e27690f446a60c054697fdd1645f9f9edb30af8170
SSDEEP 384:M0SdPVp+o5bvLB1P5C6QWWZdXXTwBGwSxCHcvvvgpzU+PSIc/3sSpXEC3rF0w4:M0Sdd4o5bt1hCPWgsZUOcvngpBPk/3s3
TLSH
T1EBA2C016DE9E1819E4A3B035446A38F6B0A5366FD106B797A880F95C5F00BFF339C2C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvmspecs.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\jvmspecs\jvmspecs.properties
Size 448B
SHA256 b374be5a723bc5e3fff8c9ad5b9ee1aab09e814b1bed53d569e82e3653af5d9e
MD5 9ea1f68278fc08c315a1457237da584a
SHA1 0387799d27cd1944a1798d82613786fc91ade4c1
SHA512 fe02dd56c7f8b2c99e7f9673128c4867b6682c3081452bf0a78420ab910670d3a9866fa0e2ce2f891795bec8a9cc690468441130abef4e3700542f9da2d4c6f4
TLSH
T1EFF0306A6193C70AA9FC5C5C70A917F0BD629BFA899C41F240783905907BBDA64A34C7
MD5 SHA1 SHA512 TLSH

Submit Download

t2w_install.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\t2w_install.exe
Size 540KB
SHA256 0674722ef9a5be0cbc025b0b3e6e16cfc367071aca61e32041e82951098873ac
MD5 6c91202857d8c7d344156525808edcf0
SHA1 33d6f45a8dafd2d1b74233035de17b55a2908e20
SHA512 3af700d3243fc2bd332b69969e5c3786d1322041280b9d2ad1e55be1a2d916c7be25862a79c0a081fae9f398f0a1ec8da5413c8dfaaf3614937f4e29189b408b
SSDEEP 6144:jA3Xp3Cb6dO/awVxtWl5PcPypqRIQ9s9dLgVUyV6h:jAHRC2dOSwVxtWl5SxIQ9moUygh
TLSH
T1F5C4F83026919236FDF316355A7C9232CAAA7CF29B3085CBE3B47549D9F2D409D6072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t2w_install.lax

Path C:\Users\Admin\AppData\Local\Temp\I1787138222\Windows\t2w_install.lax
Size 1KB
SHA256 66fd24242ab06b201596d1d04c7cef6344d0f29877317029fe5122a20cce3e90
MD5 2667bd461a20936938a44fc336d9c6f1
SHA1 c1cda0c5d3f537719abff4a1af315a63093fe01b
SHA512 c06427fd826e2a5bdf5e1f4410adc1db8867c4c097259364c8e77b7ff30863bccb18641864439a67e937a9828c8d6407ee6bb124cb80adedaf04f1777ca731ee
TLSH
T19821374E73C302E5321612AF16FA93B5212623B856E4F434B9FF590639E66CD7083C1E
MD5 SHA1 SHA512 TLSH

Submit Download

sea_loc

Path C:\Users\Admin\AppData\Local\Temp\I1787138222\sea_loc
Size 170B
SHA256 76ed0eaba7d6330645e90444e4d5d20dd6375465e459b013cc91f3425befaca1
MD5 ce9dc6ae74d5ba0f10811959d8ad7be9
SHA1 15234fb428c801edadf69c68b107ebc13fd046f6
SHA512 a161279cbfad98b21dc72f4d681ae4263a55cdf9eb6ce6086c6b1ac064edc3f8dd94308951d2cdfa395d0d39703f2f37e31666075bc1338621eb954a9db6c779
TLSH
T118C0C063008FCCB20036D027EB632488C008854E11CA17503711960C829101364C2713
MD5 SHA1 SHA512 TLSH

Submit Download

MediaId.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\Disk1\InstData\MediaId.properties
Size 118B
SHA256 1ea748ff35ede3b83065bc837c3edc911d134269bc91f821fb6b2fb3622253b4
MD5 14ce2516399745c5fe21f37198e41b68
SHA1 a981e5f82b299989d40eb98860806190b93b3b25
SHA512 ba4e0e6658c5720627bdf68d3cc4b2d0130544a8e7845266f9075971e29a3dbd5b4b2adef5971284ce46c21529420065f995ddf4a9a1d51007efaeec5c73184f
TLSH
T1BBB024F35FC41570005133D03DC4510D170C055C3411D01CD7C10103030330177C35C4
MD5 SHA1 SHA512 TLSH

Submit Download

Resource1.zip

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\Disk1\InstData\Resource1.zip
Size 3.0MB
SHA256 964770f14bbdc3e836f924545178dc6acc9bfcf1fda58aab71be1badf7b0abd8
MD5 7c1e1a15c76637da2c79c8caab452b34
SHA1 efbbfd208695637cb86921205f53dce34e6c5adb
SHA512 376539b50d63eacb423e44fa47b8dea5f1496bb773129603338420dcf06d6f0ec06ad34ea0927d079876e6e0b9cc5522f96590e07c5eb6cd050e78e1aedff5d1
SSDEEP 49152://6ZdGr7u1IdAlPaYx5MjX3UGkZSCMURTd9fzE9M8Stm8dpCLDp7B9pkD/T071Cy:34dGvhAdnu3UvRndGSCvpT1J
TLSH
T11FE5E113AD49C039EC6B52381852C252792DB8B0D3A794E776E44AAF0D61DC61F33B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Execute.zip

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\Execute.zip
Size 9.6MB
SHA256 4504c66bf4e34831c1e15931d538e56c2b638a22e8305fcce99ebbab16769f7c
MD5 edd958e9603a2368ac03a0a4d01b682b
SHA1 b265d71aed568abdb916a5a4b2fae109ea758aab
SHA512 c193f52bd330a120119a06c5787d046a9391d709bc5588c6f5a280f33b4499459e32b82064d928e0ceae09e8ed7e1e2423c11650e563a80d5c5b7e63f6824b17
SSDEEP 98304:bZCok65bvEivJ2d3K2z9lFondMWZZu4R602:bZCm5bvEivJ2VBlFojZZuI602
TLSH
T174A65B5D6F983934FE83433B56C738B9EEA66CB4016460E0F5EF944826E2D94021F66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IAClasses.zip

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\IAClasses.zip
Size 4.4MB
SHA256 f6a12a3614f4bf2a6c89ff5b2d9f2ef4ab2358b0018179c9150fb76ad48e5cde
MD5 d045c1c86912f6d8c1968026b6cb07d7
SHA1 489cc1cb18419180e8b91b853a1e014d8879b35c
SHA512 54ca033b7afd2c26902c889a08dab36ca4fac2d72baf1de9cd91afab3cf16c4616706584c1db9dba2846ea1bb7eb3d7f86d6e4c215c288e9eb9729d27340c306
SSDEEP 98304:glhzflCegYPzh2+rSSEQBD6pORtdoJD2pvW4Fl67:w9flCegQSrQBrtid2pvN67
TLSH
T16326E113E688213AED67533600524633AA1B9FECF186E0256CF59D83CB3AED51747B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstalledMedias.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\InstalledMedias.properties
Size 549B
SHA256 7e22a7cefe013d1a50d44fc6906e60bbfdf1f87f00d6dc4fcd5e8ebfc1709e5c
MD5 723a9ede0fbb345f4acceaa0972ccce4
SHA1 e881caf55dab76b0845535197e349b9b9ee68e59
SHA512 ad4f7cc01293a2c0fadb235cb323c3aa89da7a7040f9a17d8c75f64184ab4e293cb968d5a00306b228fbb7e939c257e27c4507d317d092f1e56b98e5dba3e24f
TLSH
T179F074D3EA002CEEB274106119B8B2D27350862A1A646639F7B05983554FB0799BEEEC
MD5 SHA1 SHA512 TLSH

Submit Download

MediaFiles.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\MediaFiles.properties
Size 3KB
SHA256 29d13fdfe09de3211a2435afd9f576d5a1de4fbc0207ad2d4b2ab6f7482c1a43
MD5 6732b6c2d9d1cc368513ab76ea9d81d4
SHA1 06dfc502eda5974412fef7f6b70bf27e3cf15f8d
SHA512 14518afa6effdd22f60e26467fec7c4882e21573ea703fa7275af88d1794bd8baa85a821e2dd08b400acd5e0ed4011373328cb4b9e054f5178b06b8f3f030385
TLSH
T1D6713D2F9FAE8F75A770F9C244AB45187A55B10DB054033297F06F3A6A79243D0EB18D
MD5 SHA1 SHA512 TLSH

Submit Download

laxmanifest.txt

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\laxmanifest.txt
Size 1KB
SHA256 1aab428d38e12667c7585949b032aa113c181e4656e847b17dfaaa9bb785c45c
MD5 e96e2605da8fe7ba23cdb9e79102e094
SHA1 9bc71b9fef2f2b34eed6837fdeca944c29fd8c2f
SHA512 e8433b1b1a41e2519522d8e26c0341095c5f430920ce1efd4da0a51b74b2d17fd853337de2d6c7036b369af533f0fa5d130481da8a8b19260bc338bf1c65185e
TLSH
T159314A74440052338E9B7917207097B5FAB25FDCC4ABD0945AFC899DE678EE64585730
MD5 SHA1 SHA512 TLSH

Submit Download

uninstallmanifest.txt

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\InstallerData\uninstallmanifest.txt
Size 105KB
SHA256 b3ca04584380554081286de8d0c21ecfff2eb93f214811ea9bf85751b00a6905
MD5 ba1ea572fe35ca6acbc198e7670a9519
SHA1 0b3b8484a6805f598ec7e12f8f933fb6fde67e78
SHA512 8c6a86bcd87d4cf2ce2757cced759e8c00586952b87fe56bbe318d23ac3d17869bfc8a492edb4e5f5e3d42d67920817f12881e16fc5c0e279fbb68961faee1e8
SSDEEP 3072:Vz8TFvJB3OsvJwSNL820OC+TFKgKg2UcWW0Cpn5Td14ubCQsU2i2IKe:Vz8TFvJB3OsvJwSNL820OC+TFKgKg2Uk
TLSH
T199B39920D70422732E572A4B00720671B6B7EFD4D2D7A090ADFD9D8DF56ABE12143B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Verify.jar

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\jvmspecs\Verify.jar
Size 1009B
SHA256 6007094fffce97c3ee54551f70a16de544d6c7e9ec2ba0ec90406e16e879d88b
MD5 9ce46b4b65d4ae4f9f4a5b42b1e9d86d
SHA1 b1f5b77657bb69574d484e94bd0ed64be9f6f751
SHA512 9982c32ab83a14e8e3838aa058d86d98ad7386418eb00ec83bc880795bf29ca1275c4eabe5f3c5f8155e73ada451369006eff7537fd4f819a1d12c65356d286e
TLSH
T19E119C2FE2045C1BF6C9F2781A88472F7631A13152FBE218AF4954665ED645029297E1
MD5 SHA1 SHA512 TLSH

Submit Download

ZGWin32LaunchHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\ZGWin32LaunchHelper.exe
Size 93KB
SHA256 fbddbd5cbcd9581a1fc1df98088f0a9fdb5033f3db6ea3d14c4cbf11c3718b19
MD5 af911b5f3e041f2a5a5d4765a20328d8
SHA1 004df4135fa5465f83b06e32bcc5dceffd22d669
SHA512 6d5c7e50bb3df7fe77a34e6b69ded330ea7261822c68f1b45c9acfbc2616a3cf289599007a7b7dc2dd71e1783a2860191751d676287bf66150970e20cae6b77e
SSDEEP 1536:JDtJYGYXJlbU1ckR9sWjcdCJ+ZihXQUqGJD:wXzbU9kCJ+8hXQzGJD
TLSH
T1A7936C0376E18076E4E34A3059B0DA625A7FFDA24BB49C8773C8028E1E756D05F76B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iawin32.dll

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\iawin32.dll
Size 108KB
SHA256 bf638aa5ee0fa9cceb0669cc5754e6b3f27377fb82174aba9062d804d3fe9780
MD5 97411ce12f63f05c2da5699128ae76f4
SHA1 feeb0d1c93718c2e42a69ec3a076fed4d25b3b5a
SHA512 fb9a3d1db9e7b956b5859f9a6e9f9271fdcd221bae281fd0d66285e6b739249e57d0952857f64c6e723158302dab4e21ff8bb3b80f5cb995295a5c2f7b5a07db
SSDEEP 1536:x1M4Ub07MUf5fp9Awx3OGtQ++YL+7ncosWjcdQj3yjEJBZLyAEK:MJAFf5fbx3OP++YL+7GQj3yjEJBZLyVK
TLSH
T1ABB36C013BD180BAD2AF0A3418749722973E7D71D9F49C5E6BD60B895DF06C1AF36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iawin64.dll

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\iawin64.dll
Size 303KB
SHA256 e8312802e4fd59f2d1253e8b5c799682c3a9f1ba8429d8eb312ce6ae081a84b4
MD5 9eaa54f82d1d5e17e67ab5ac7ec6e4b9
SHA1 e4d110c4c07a78c5f5b33c4f29e6187fcf993aed
SHA512 1bf18233e4571f62b9694b91ec36361a82c890dcc43ff866afed2f4bf014a17651736827fff260e174d506cf2de3f7062b1e0eb72158f796bbbeae8c058ac69e
SSDEEP 6144:Q0lm38mhglKT56s46AHdicJ/rgzApb0dDM8fg3DHc:Vu4Hpccpb0dDWo
TLSH
T10564E846AB42EE6BC60F033182E70B2D23F2D39557F3CB2B5A7193752E4B7891725960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iawin64_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\iawin64_x64.dll
Size 130KB
SHA256 8e6878d90c4cd23f76fc79b912c4a443539bb09144b73cd4a389247dc9a4d178
MD5 df6e9c60af948f91181d42902a335662
SHA1 cdc39d8fc231b3a98a1a5d0bba9c838e247f1c4d
SHA512 27876a5455bc80ce25e4acb479b5124e4e929eacaf3fabab7c81ccbb4547b506e679a08fd48bd3ee33cad4a6fe0950df3090a1bde6d8c72d5b457a903237b23e
SSDEEP 3072:3JRwjIymIer9JBhsxeYTRBiK7pMf5NY+O4LtM0E7b3g9HUJBv6Pxb:3Alxer9DhsLTtFMfjY3yt2bMKC
TLSH
T1D4D35C4B33A400BBE5B39678C8A34A06C7727C5557B5ABCF03A042895FA37E15E39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invoker.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\invoker.exe
Size 20KB
SHA256 22388997e82d9edfd11616c65084bc0f81a1421027e1f39ee885cfea0f54a288
MD5 4726ca7a8eeb86bdaa1c8a0ba39428dd
SHA1 2e851728e6a7fd8dd5a4c9e1b0e48945769393b8
SHA512 d8e437eb90309ea19af0da4f45277bc9d192ceb7c892b1f8a880aec48e1f7870dbe1f30dcdc9b16f582abb53af8384eb9d14394a90e940bc4b5a590818b59360
SSDEEP 192:+pmBS9Kr1xj+oqetRHLaz7kxbppHDmin+j0ianYe+PjPrSBO3Sw2/xz:+vAjUePHLgkpppHgjPanYPLWhN
TLSH
T1B7923A4B9A566072CFE28C30EA57A52DE83BA5B01BD95C477AF481844CD4BE9721E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remove.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\remove.exe
Size 191KB
SHA256 fae081828392c2ee768196dca89b20b568997c2a68c3372c74c6a2be06bfb31f
MD5 e9dea33aa3632a27f6962993ea1a2432
SHA1 83661220db3e11484924ae3616dec24a23326c14
SHA512 9dc282253a96de863c3fc8cda59c2f50f7d16e98cb3d5d3d6e80d49d11b9f5442cca1765d71e60446595c4027f4bea9c8494a0d957478a94c460cca48dda76e3
SSDEEP 1536:3V18k88XOlsuPzaSRWmrrsATFpjlbejFpRI+Uc41wkZs8jcdU85eCvOQKMEGOsai:l18NbprcI+SMU85aQyGOsec
TLSH
T1C5148C1136D180B1E1B3023615E8E7729A3DFD724FA25E8B77D84E8E0A741D06779BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win64_32.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\win64_32.exe
Size 227KB
SHA256 4565774e49462cc115567df2b05be2fd7b4b42e43b462fbf49d9728910da3d9f
MD5 5a2c76ac4a09b5fb9bd5f43cf48c5d17
SHA1 b6e312aa4b97be7e8d27be2e8de83d4e97e31614
SHA512 8036e76c9903506b98fb51b37714d10308966e43a6b6f3b298ef14f3d720bdd36712529427348299dc481abb8fc5007fbfe89b994ff005b4f298ab156ef2688f
SSDEEP 6144:FxTHoinXTdfGqJs+hS6LE5UZv7/JveegT1:ruuZSO9eegT1
TLSH
T12734C6467B42EE6BC50B033182E30B2D73F2D39557B3CB2B9A3193792E4B7895725960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win64_32_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787138231\Windows\resource\win64_32_x64.exe
Size 103KB
SHA256 7d9b7eddda5f678a7fd201ed7b9a985549f111993155d5916b7e7ac85ed8393f
MD5 ed623135e060104e4839bfa995cd6023
SHA1 a0caeb82cbc005f8e3613869ec4297376ffd1d6c
SHA512 77dd26a6c195a17a439a003c9ef4c9bc81bdcbd1ec944cca009eb499800182fe68d8336c3e63a1f9d73f61f992df71c737a15b1c1406305c995c669f21bc81bf
SSDEEP 1536:RXkKaM/hifFLjTeXlrHLQLjSosUEYu60hae+Bs8AlydO8pyju/hQx5X:RXkKa2hifFXT0pHLQnSos5DN+ft/hQ/X
TLSH
T1ECA35C4B23A430FAE1B7CA74C9A18945D772F87547719B8F57A4028A1F672C14E3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lax8095.tmp

Path C:\Users\Admin\AppData\Local\Temp\lax8095.tmp
Size 6KB
SHA256 96aff363e5bb0512a72833d56706e811153cda30c9936335081619b16d3f379f
MD5 51ebaf8090f925633b3b0691be8372fb
SHA1 c3c63594d4f3216b3e55df5726d0f141d35f93f5
SHA512 3b802fddd346fcc622957f6c14a2868154cad26f3a9d1412fb1280053d575b70c8c8b822fcd1844baa9ece54acd859c16f4926242b8fc03742998e5e6774b4ef
SSDEEP 96:cN/zWdbU65qrBfKHTi8Im3ZTkuupIHrzLDHrzRHrzEFb1e:cqqrBfKHTtT5XpEFb1e
TLSH
T115E19A12B6A1D5B0B4422714A2DA1F6CC2B4F41D7BE4C6E1534C9689F9F0F498B2FCB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nqOku5MP.xlsm

Path C:\Users\Admin\AppData\Local\Temp\nqOku5MP.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3976-420-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-598-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-401-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-402-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-385-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-415-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-416-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-482-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-430-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-478-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/3976-470-0x00000203D02F0000-0x00000203D02F1000-memory.dmp

Download

memory/4024-278-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4572-128-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4572-0-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Download

memory/4572-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4672-601-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4672-645-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4672-657-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4672-355-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4672-571-0x0000000000400000-0x000000000115B000-memory.dmp

Download

memory/4924-465-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/4924-512-0x00007FF8691B0000-0x00007FF8691C0000-memory.dmp

Download

memory/4924-497-0x00007FF8691B0000-0x00007FF8691C0000-memory.dmp

Download

memory/4924-463-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/4924-466-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/4924-464-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/4924-462-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads