stihat | 2f4d952a867ae032caa7a3c07c75cbcbbaba695b5365066ad0356640d9062ec1

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
Size 2.6MB
Sample260827-sdh1pswhma
SHA256 2f4d952a867ae032caa7a3c07c75cbcbbaba695b5365066ad0356640d9062ec1
MD5 73a6a3325648e47232618a76cd0dde4f
SHA1 7dfcd8cdc7ebb54bd60e50579f75b34b66d8ced4
SHA512 cad9ae07e7ef1af5352011642d0d6265e2cde18f17fc684f185a75a5cc84a70b41b25b8b51a93d9766f74210e32e723b41f6b1fa522cf501098a211f312072d1
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MC1:eEtl9mRda12sX7hKB8NIyXbacAfurL
TLSH
T163C55C64E610D8BAF3D6E978540E7F291CE17D120BC22D4DA49DAB241FF0EF4E5B2294
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 10 IoCs

resource	yara_rule
behavioral2/memory/2144-0-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x0007000000016b3a-6.dat	family_stihat
behavioral2/memory/4864-8-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/files/0x000d00000001c4f7-31.dat	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/memory/3456-43-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/2144-42-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/3456-45-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/4864-46-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat
behavioral2/memory/3456-55-0x0000000000400000-0x000000000047B000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/2144-0-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000016b3a-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4864-8-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4f7-31.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000100000000002f-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3456-43-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2144-42-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3456-45-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4864-46-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3456-55-0x0000000000400000-0x000000000047B000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
4864	HelpMe.exe
3456	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\U:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\I:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\X:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\J:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\K:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\A:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\H:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\M:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\O:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\D:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\Y:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\B:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\G:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\N:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\P:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Q:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Z:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\R:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\V:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\W:	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened for modification	C:\AUTORUN.INF	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000d5c842235e10dd01f4107ae36810dd01f4107ae36810dd0114000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4456	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4456	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4456	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4456	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 4864	2144	2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_73a6a3325648e47232618a76cd0dde4f_darkgate_elex_gcleaner_luca-stealer_njrat_rhadamanthys_ryuk.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4864

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:5544

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-2301830172-776172150-2531349243-1000\desktop.ini.exe
Size 2.6MB
SHA256 114afa252451871170d26c58d89775df0da2febec9cfb17e05feb9c01766e859
MD5 5986294f3a2900baa321305d260fdc96
SHA1 f100e41b085de7f7059d12c359b34729b48d3b80
SHA512 0197e06c64689f34cac63c4d54c5209d619225abc0803e3f71ae6be3e2c36645834fe2caeaa642730591e62db0436435adb13f9a90c43874fda9758d2d7d4358
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCs:eEtl9mRda12sX7hKB8NIyXbacAfur+
TLSH
T1A7C55C64E610D8BAF3D6E978540E7F291CE17D120BC22D4DA49DAB241FF0EF4E5B2294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 34c117169dc3a693d62d41ea2b8d454ea157f5c8a245ba253af4d9273ea7f4ea
MD5 eaa6d99bff4a3d746af3ce698c6fb161
SHA1 e7872a8dedee29b3e7a7ad426031b08b617524b4
SHA512 44f9de21a96db62a11b294e5d07ffe27a6cc397048be53f1cd3c636826923432e69719895709e2c0078fb3be1192de9299f88eda595693ed67219bb53079b0f2
TLSH
T1C0311E1A19D61B57F37BD7B6D6FA052BA6B2FDE77620EF0C00A042080C2578268C1F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a27a37402a90046ef1845afe161b26faa24489f46f934815a70b25315578eb4a
MD5 8a4c62c5cb8523dd05f1d73343a9b32e
SHA1 bce6cf8aeb6e1316ffa6bd5252f53cea8ac18da1
SHA512 7c0eb3ebd7416c45670d8ddb545af1086bec20cfa03c26cd9a487a22381168cb08a594aafdcee387c70beb4c00ed38d080f654efe3535f2d9fba0b2f8c826b1a
TLSH
T1B7310F1A15D51B57F37BD7B5D6F6452BA6A2FDE77620EF0C009041080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e68a32fa66b2b5dde2205490594844986987470e19e4243c0a165e0822ab83ac
MD5 46e32c5143df86b0ed1ae44c5f6fbc93
SHA1 717126dada742b844053dced1e212f8915408b57
SHA512 1db93fc2eba0c6edc597c3c71931bee4100840a7554578db8a0f35e3f8f8e398ec4cd6f0d9e4249c4a91246254528cb20737af0ece99a3dcec2908c56814fc31
TLSH
T17511EF4924D12756C372873A81A31721C3B7BD03FAB49F6D008602C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3fc829e77ab7f4656a50732e15ced721e0c71bd33b2574a8f12ff582824d20d5
MD5 ad9aa6c02996dfa941eafd43ee38e9b3
SHA1 13efc0af7603019a1dab2a46af660c967acec38c
SHA512 127e20dd1039bc10e9b5357b6eda1e2940a64a89003b2b97b62131cce1dd854c40169fb48bae0e57dc2f1bf690e8dbadbfe610acb59bd7d27c602ba127fc89e7
TLSH
T17F310F1A15D51B57F37BD7B5D6F6052BA6A2FDE77620EF0C009041080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a38838c1f4ad7c70d0420d0087e23873e9c44f1d47871468ff18637fcab68677
MD5 9251e759c8d40b2e1d202a8f3f6ab45c
SHA1 08791e2102085a59f632097a12af1ab7347e7d2a
SHA512 407150f84ede05ff59d6b478d66a5facf8b038fbae9a1de5d51c0152dd78531561ab684f83a9a7092b45a7a4157ba5cc4c97d6c477ace584fd2f1218e5e69766
TLSH
T1E711EF4924D12756C372873A81A31721C3B7BD03FAB49F5D408602C45C49203A9A9FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5f224b2fdc51eded6c367e1d153fa8fb46b2be09113bbd9108abeb0288afd58e
MD5 724c869d072ef89139cdf7e4b5d0790d
SHA1 1a59e20b4b8696ec56370526e4d105ad6500deb7
SHA512 788cbd19c5eceeb48b6009daefe72d9698ae23306678663f589d45eaa90e7e853908f3da9c26fb19266c88ac383218d128ada287b36e940a75015bdb9d0e8d9a
TLSH
T1BE11EF4924D12756C372873B81A31721C3B7BC03FAF49F6D408602C45D49203A9A9FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 951ee5a7248fd825ebee65c6e43611a79d5186f00f1f948a561273bfc7536f77
MD5 fa4665dfc9299b1ed221277d8ff9511a
SHA1 3d19cb56cb934e6a6e84fef21053ff4a5b90d87a
SHA512 8ba6376270f2d6cbd15072955f565898417a6c42024de5a17dc8ff4be63f589eda956eb00135c9e336fc35516f4e22e6b6cbda2769f1845875bd3599dc815027
TLSH
T187311E1A19D61B57F37BD7B6D6FA452BA6B2FDE77620EF0C00A042080C2578268C1F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 68f270eb8ac3617fba1d581c02e211af1f450a890a1b30a1e0ad5921611af71d
MD5 37d4f87127983236fa53e4fc5764d28a
SHA1 38a111a74163662281c53600fd1c73d50f55de0c
SHA512 3ad59dd8a8c3c9f97763efb5ba89f17315862e4d02823ae7b9f5b778aa6f4764ff5cca9b6c25612d2f82a9de43c22ca0bf5e58067b5102d6e495e17f2bae9af0
TLSH
T14411EF4924D12756D372873A81A31721C3B7BC03FAB49F5D008602C45D49203A9A5FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ceb997c23c622a65150e71da88e7e13aa0a58b77b5b79e4872cf041fcf817744
MD5 051f817a47d97b459d02c4efef52b75d
SHA1 c38605c89c6ce99ed54ac9f54962e5b355a61b27
SHA512 672ffcb2245096abde7d12a454ce8300a05a842a7d75d6c4c305645887bd42a9dfed0419f71f013ec85c2cf43315ffe34cc2014484b8c0c8ea769531f0219c98
TLSH
T11E310C1A19D61B57F37BD7B6D6FA052BA6A2FDE77620EF0C00A042080C257826981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9195b8aab27035e6562588e3dc13217d863eb51dc1ad8c472d20dda0820fb819
MD5 2423069bf831f90efc7efeeb3cca5254
SHA1 5168543aa46865bebb22ba3a9a057a81215b86a6
SHA512 e9916e7bbcefd676b56ea318bfb4c16cc9221c041a54241404d92bb68d3cead0b9ede3121a93b39fb052a6ff09279a15aa6f87a517cb160e56fc60590c737f33
TLSH
T1E411EF4924D12756C372873A81E31721C3B7BC03FAB49F5D408602C45C49243A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e1688222badb59091a0a60289539dc9add9c91d335c991da92db1f6f7c25dc15
MD5 c76b10428fb8acdc697e4b91a4057856
SHA1 86cadc51dba6626b2be3d41dda7abc72a6019310
SHA512 c770cc51589e1a2c0204e364437fdaf8aa852d3692bc86cb23f32c48ed26a999bbc718680740897f66b91ff34a271269f53e78c7edca00c9e6712c8068ac58fe
TLSH
T1A311EF4924D12756D372873A81A31721D3B7BD03FAB49F5D408602C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 28ee36c71e0c0345ed8d302a0e6f9f5a9f885a1bc238e027be4572cfa01a2742
MD5 caab1a4fd7321a19198c9efeb72bd529
SHA1 9ea6bbbef86ec13c524f3c57744de9dbdfe0ac74
SHA512 b555822b02bb463f7993274ecc86fc4d53ab609ac1f9820d2fe418ab2164a52453d3de70038bfa998e63f8a986f733e2c7e1e8286e3fcf9b84972dbe319d2388
TLSH
T1FE311E1A19D61B57F37BD7B6D6FA052BA6B2FDE77620EF0C00A042480C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 76491f8c1f25dfce0b5f2260bc630e39a8e97a998d1929b7697e5eed9e660b1c
MD5 803c3280a3b61b652eb675de47255d65
SHA1 9907aa9fc29fad0a8b3c28520f9048a6567eb93c
SHA512 ca38744d3204ddbff1c115d103bdb11f8a4c1ffd1ec13d364a8670c71e7ec4967435a0f4bfe7990b8ca4be8698048f3c83693f141ed90ff1ba136153ddc5bb4a
TLSH
T1EC11EF4928D12756C372873AC1A31721C3B7BC03FAB49F5D008602C45C49243A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c6f918d1982123e9926fffa6524ec9477ad413708db686fa949638ffd32d3769
MD5 228512c6dee847edb79614a709fd2c31
SHA1 737ea08f542c20fbaf6c654dfa3d6c5466d87002
SHA512 9234212e62ae5c268712863a57ff7d926699417588d3069e70c8b7b0811eb39d3b0d7f75a71606261a9230fb1ccac4128d5b3a1e9d0e9beeefe744d29669c7da
TLSH
T18731111A15D51B57F37BD7B5D6F6052BA6B2FDE77620EF0C009041480C257827981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 0f696cd56cae8939d9fb29ac1bc96f18a6547b2ece74d3083aa8a53c242d9603
MD5 c1fb7f97fabe4c166195cafc3a1864a3
SHA1 21616139c156977a0fc64090529c289f982ec746
SHA512 2b47a41613225000e0debea3b315bc076b0513d3e5ba94924e58addc11364f26021db33dafd61981f06cbd5ea99144b0f2644053f7dc233e2d091859c811b066
TLSH
T12311EF4924D12756C372873A81E31721C3B7BC03FAB49F5D008602C49C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 022dab14280bb620cb59acc897fe40243bfe0b499c9e0ac40078ad4eb49ee598
MD5 d214ad636f5f529237a8367cf1126673
SHA1 ab3673c3882d8f939a38a45921783a2ecb39c9bd
SHA512 9108cf24ea160eab519a7ac7f37737870b467c22fe402e29066fb273d69200032f0190bba77e5e1252019697ed155913a8b58e846c08ea755612e435d94aaf04
TLSH
T13A310F1A15D51B57F77BD7B5D6F6052BE6A2FDE77620EF0C009041080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e2be101f541a7e32bab0d6a07bebaf6d2b495d834426fc8ce1a06e8d8b8d3ad9
MD5 3e43838dafc37c4fab753a0c9f35371b
SHA1 6be33791b16b21d60d6caec0b18f5ef6abba590c
SHA512 4403f2f0292f95a7758687158ac0b053e8cec18c4980dffd9f0e16184182c30a2c9457488f34ff0e6e389ea46c8e7c0127ba95f1902cc81ef4bf621fe2ebac45
TLSH
T15A11EF4924D12B56C372873B81E31722D3B7BC03FAB49F5D008602C45C49203A969FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 597ec4513456e610c1e05bfab43214e31c90639ad1988c9c98928f410b8848f1
MD5 32c75151b9bcbd1cbf85867ea86b51d6
SHA1 114f10a179b715ab749bf26d456b5db72f8b341b
SHA512 5518b9f5ae4cefe87073983ab511e4d5f8a527c6503961b71eaf0e3ed1bfc5cf82613e07eb8876fd2b3a8b92edd6e0ca9c44d5229b4093f0e037650c2d129634
TLSH
T1C711EF4924D12766C372873A81A31721C3B7BC03FAB49F6D008602C45D49203A9A5FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b28305b6325d5d1a7a40dc7b7c62dec9a21c0ee0210972343786f3e0309f21df
MD5 2a764692e0239927a7391ddcab4041d0
SHA1 51a5b3aec3a663a77991f4614dea8252fcd8fd18
SHA512 f61d1c85b6b46ea12e50dd93fc91f0cb08efcf0ca745c957cba2c1e125d1558adbbd7e709e4757f8088a76c0e660beb795581c221b6bdbfbbd9effef0003274a
TLSH
T1BE311E1A19D61B57F37BD7B6D6FA052BE6B2FDE77620EF1C009042080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a468b27948433b6d81120107e6640a8814c80f65df203bdfafbe857250226fbe
MD5 be354e000d3e32240e5d8e57cd03a7a9
SHA1 bf67c91adbb637d59444e94db14a9be2c8c1c2bd
SHA512 89bfe402a997d39d171967a4b8c842453136c27ae84cfac5d5e7713c94f50144da0230aa5b2122697f579f6a41af6eeeb5635982586112ed1651052fd1b08746
TLSH
T17211124928D12B56C372873B81A31721C3B7BC03FAF49F6D008602C49C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e29d16de754e2296db0339ef1788b547a9fcf0567bb5a3b569d5698ae141d3ff
MD5 c0e29e4833adb078e80553c38cffed5c
SHA1 8070d28051a1fc730ea8b30733c3a8e654187b12
SHA512 28ed8836e3a5b3722f4bfea0d50124c00923facb1ac681844729527fdb1bd4aed6965f0e591275815d352f1b22f8dc32edb757599f6f7388e161accec4a2cb6c
TLSH
T1A1311E1A19D61B57F37BD7B6D6FA052BA6B2FDE7B620EF0C009042080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 09fd290b345bfb4b04bd79b132089f1f3b786eeed96e59a05fe7705c6f9c7aef
MD5 7077711c773df03ba2e3dea36f8d056c
SHA1 b96ba8db56b3b3a7eeb832220d8cf7ab89dcc1a6
SHA512 5792c2df1ad89aa9ec42a0632b5244d5a361df7396ec6448c330418b0522f05087d4bc8e760b7d077ec5196df04aaf181e80a575a162eabd22d9e30ee4a64fd4
TLSH
T104310C1A19D61B57F77BD7B6D6FA052BA6A2FDE77620EF0C009042080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1f1a2c01c5ec9b109d64f91e82e78204b5f8b7bc95e2f94a20049c03839d019c
MD5 3363903f89229158c26c434910c556c0
SHA1 3bf2de933a7a6a82587267201f62c86f6ebed7ae
SHA512 9ca15930960107152de55c6699ea266e667efeae3a073a40a05e47b9af9b53cde46236007f7f6f66250be03e90b406110e68332d28e4397d3642538fa4183da0
TLSH
T1C511EF5928D12756C372873A81A31721C3B7BC03FAB49F6D008602C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9f3c6904a118b5e71f44394b197e2ad2d55033b64400b52e451d875812d72d4c
MD5 9858bf7b01e56fbe6750ce3bf545a136
SHA1 9eb2030cb15370bd04269fddd11bd17230df4ac8
SHA512 bd6d9f352245e4c6315503b384691f3afb48c4a941b3c71dee2bf391e169a263067df3f55827090e3b6ae61b552ea2af3db20196c408af3b05f1912b586ca9b8
TLSH
T18611EF4924D12B56C372873A81A31721C3B7BC03FAF49F5D408602C49D49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8da7b4f84693d1d44f5676e5ee14082a0d86dad56a985a53bb8d733f5016165d
MD5 5b796c0591fbb865b5765ed329a929d0
SHA1 bd0bb1fce0d22bcb0a04be21bb0e6aba1898e556
SHA512 c4ba23c7de48794c86286ae4dd6054b2ba6b81d5737cb26b96e6a9bcf67f7b48492949b11cba3d0eb17a0f84622d06c70b212dea0b6cf73dfc9a39f11c59822b
TLSH
T1F1311E1A19D61B57F37BD7B6D6FA052BA6B2FDE77660EF0C009042080C297826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ebe0c1d6813a22f5d9cb9e118a0ae397ef764916ea31836e3659a438549f4727
MD5 f53988f94c98ec1796e92500cc62eae1
SHA1 5541aab82653232a733fab8a69c54337ab2bb22a
SHA512 d4e3b5ebdd033b66a6a6281c6202a9dba42606c2f2219a48d115ef08569d103d383705b99429fb4ca7eff3d21990aec5be909edb59c6be70d3703614ba3e22c9
TLSH
T1C411EF4924D12766C372873A81A31721C3B7BC03FAF49F6D408602C55C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5ce29cdef72daddb7e3a74d1ec0bf0379901e4d69f6db47e6606f39ca0309218
MD5 09036210ad48c4755c84256449895178
SHA1 42eb4b1f125b69f65ec602a30f05f715717c55f7
SHA512 bb38ac96067a35994fc4474f328ccb825231eda319ae61c4e7c5183b89682b34bccae6e8e3afacbf35eadf2a3518fc9c267879d5cbeb9951a95705c30c7d0268
TLSH
T1C4311E1A19D61B57F37BD7B1D6FA452BA6B2FDE7B660EF0C00A042480C257826981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e52bb3b2ff53cd72d52abd9a5a22286f7ec47eec3905b6c84f8a1cf3a6e7560e
MD5 e4fab54c89e53c9285ac9562adfa5fd0
SHA1 60d50bb83ce750fff24902fc0e19e58ca9961bc7
SHA512 d7a5fbf465021cff9ef9b2e0a4761350af585c2c998e6273856ac401ec5e46bd30c4b6578f0d3976b2cb21387f5ec7443ca6407f0a0c92d94577a5aa80e5799c
TLSH
T15A11EF4928D12756C372873B81A31721D3B7BD03FAF49F5D008602C45C49203A9A5FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6fb820249d585354593e10ca47b5532e759d783e361dbb8a1e34978826b7281e
MD5 58f1774ce6b6b7d6d9ff7e43f1e0fc27
SHA1 651fdd680c2879ee633510943ff23e35f57e2dfb
SHA512 6cf638665f69c2ff027fd13fb4c3d6198f238677e7dbb96f745811a4302d2e6f13ec6cc1e157d678aec4acba2fea39df4641ea025f3f9cb3a1baacf0b656329d
TLSH
T1AE11EF4924D12756C372873A81A31721C3B7BC03FAB49F5D008602C45C89203A969FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9d3eb9abbb826084b766bdd65a3de7020d298046cdec66e9e938f49d19fbfd55
MD5 3df8eb9a00a17014c311b5cba998975d
SHA1 8dd6c304cd2523b972e33b5882df4dc03a806590
SHA512 ac190e8ef3558590ca0514dc20ce6d4be61b986240da0529a61d24c99c0cd8a497b8b2b40cd437223e53bd7249519866237ece5f0359c8908bf7047c52b80646
TLSH
T10331111A15D51B57F37BD7B5D6F6052BA6B2FDE77620EF0C009042080C257826981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3b42d131f60d837161e24314326911c8926f65d79f9493e3f126e1cd4b2ef4eb
MD5 d6ab180950474cee91fcfc0c58e3cd15
SHA1 4bbf912b217776ced0dda04b8f3950a6daed1d27
SHA512 96e7f461a42b12b38ee2a3ac403959139c34f32e95d03f5f4d7d31e33aa837e0c62d63d8909a014bb8a915f428b6af3d6ee19ee8281b93063d6046646cb30c19
TLSH
T14911EF4924D12766C372873B81A31721C3B7BC03FAB49F5D008602C55C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7567cd474938ce4e55987af84652b3f92206565d4ff39cb777745a3f9edbafaf
MD5 b539f7f235bc75f2b51c0a28ab5a9a6d
SHA1 7ad9068f89290416484c1310a252f0ee1b6e66f5
SHA512 5dde90913147d6abd4dc3b621c0ca161c1119065a121ab560d00bfb77aed2a6f5baae4927e1e1ccdec03f13411f28398833a1dc8090a40974b3bef9b4731ef87
TLSH
T1B3311E1A19D61B57F77BD7B6D6FA052BE6B2FDE77620EF0C00A042080C257826881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 564ee1448298840aa11a730c7665c57fcc1445d2731802d60fac3786f5b57683
MD5 4d950b6710fe8807e7a5e4a90f406851
SHA1 42483a86b5a30e0739057d3c1987ca865c55aa15
SHA512 c038c44f10026c9cfc427dba47a3a19e68bc15696102a2f03b719b73945997998e7b1cf3f5a79e1215b8eb3ccec500e7a1c87be95c6748e5092564cd2b43e8cc
TLSH
T18E11EF4924D12756C372873A81A31721C3B7BC03FAF49F5D008602C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 eb99b5881139dc2e0c4e955a1aa791d5881e4b3fc88872154ffcded5463610e7
MD5 281a5d9b691780989170028500044b36
SHA1 a5433a47dfdf2d80fdb9c207b9d13d0b07319abb
SHA512 46221c38b84e449cf4f0831dca94d92bb2dfc1489994637fca7a687ea2ee46dd38585b39ebf07d8fc50b35ade1f399c2acc93c5616bcebee8056c77d07cf2244
TLSH
T167311E1A19D61B57F37BD7B6D6FA052BA6B2FDE77620EF0C01A042480C257826981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7fe68eb63879db6ec1bb1a8a5cae68e661f1819ce25ca4eafe2e6e9ee5d63bc1
MD5 e3019b93fe794ae0a4934c721ed4b60e
SHA1 e3ed94ca8eb271f5658b6da93d016885d679b750
SHA512 2eaf34ea4db4dda98617263cd54220729fccd1def8717b2a2a9cb7476b171b3f15b28b3223839fc05afbf0ff178f25790234364fcb825387949a62f0d0509812
TLSH
T1A411EF4924D12756D372873A81A31721C3B7BC03FAB49F5D008602C45C49203A9A5FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 871a7930a54655de81b5cbef776dbe48d1f31bce4fc968c74ea5b79bd4d2f5f5
MD5 b05799da33a78373d2b56e00e73d1904
SHA1 a0361c3df5808b19713d20d585777b4bfa1fd70b
SHA512 9dfb9f45acbf77010b0e0ee05aa564a3d989e77052f44a8558f24e3fbf63d74d6387b9e4b50b851cc68c53ef4c5b25c2ebfae0b1e2775e3229369d4d08d22967
TLSH
T17C11EF4924D12756C372877A81A31721C3B7BC03FAB49F5D408602C45C89203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5ed8d282c1fcc647f4037c3f60ddbeaf564c559ca82c6c96ddf7ea4e22eaa028
MD5 6f2f2221d167705d79f69498e9351fbe
SHA1 880876d23e19f58b98e9d84f284d29d7a28001f3
SHA512 39c22e31281ed459c65a50127a55b02e83026264526b81b9bde93e225969eb42c4bb6f65c8b68bcc23f4ab940ea178937e36b35e5922ba05252b010128bf0d75
TLSH
T1DF31111A15D51B57F37BD7B5D6F6452BA6B2FDE77620EF0C009041090C257826981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b757a3efceb3145a772389866adaadfdb8872bd89df39d079dbe6694538acb9e
MD5 e1bbc04219e6bca949ee572a496249c3
SHA1 9096f440fa3cbc96ab114efb91df36175c600987
SHA512 2ebd1b588756b6db108da433e769617b2ff85a5ec30a521b3a40cc79dcfa5a3f140a64825729153f76a772e325979c088d39a38a1e79e00313a02b81df87abef
TLSH
T12F11EF4924D12766D372877A81A31721D3B7BC03FAB49F5D408606C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1189be0fb2d79dd5a2a46db4a9b33faf90bcfa332d34b10f6c75042f3eef60d5
MD5 7741b1ee6f53dcf3fd61399d8981a17d
SHA1 ecf59af899f73f40a33273bc41e0a653b212919e
SHA512 ef07080eb2d2b34841de5ea8d3a73abe906c32b3853f0f7fbe1f0480181154d88f78d9bbe46a1760af9a43ec4549f187b59e309fb981027d565638b245cea953
TLSH
T12A11EF4924D12756D372873A81A31722C3B7BD03FAF49F5D008606C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ad4b6ee17d6d7552f664fbc952235323a3d6f42410afa0e79004c3596ff56130
MD5 73bfaa9dbfb45b87c346c7e041bf21d2
SHA1 e373332bd63bab2e182bff10532224168c85aa43
SHA512 55f89806b21bb382a97b07a15bc86da905726e33b4b4028217b2b0e10d430e0631fb69526282ffb3294b77d12b5e7a115e4451f990235dec061820b92319729f
TLSH
T1E631111A15D51B57F37BD7B5D6F6052BA6B2FDE77620EF0C009041080C2578268C1F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f117201d6a5a0d50a00445c5c1a2c9963e98ec3e38d7911a79d56e32b1339a28
MD5 b4cc7acf31f09eaaf361fcdfc71d4a4a
SHA1 983c5c76b88e0575c0cced8b13f1ae64231d7d81
SHA512 1a6422b2f264814022718d5ded36fa33fd952131f69195df2ff31484d63efb5336f23bbb5d1e654a9f0d8650af1abb9e17dc226e1a772be5daba5143ef2d24ec
TLSH
T1D011EF4924D12756C372873A81A31721C3B7BC03FAF49F5D008602C45D89203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 781fae9a2ca12559bc509274f3a3bebf3b196762f449770d2961ee09fac2f7df
MD5 94052961848bce03d103121a8fe686c2
SHA1 0c9e28ca48f84f3275fe584a2d32a53a9ed075e2
SHA512 ccc9fec7e8a127df695b63eacfb4f2b02308adfd572f95b9bf632bcb522e1274a0ed0e579cb8756f195d36fb1c6396bdbc952af58c2b16e773f15b764f96bc33
TLSH
T16A11EF4924D12756D372873A81A31721C3B7BC03FAB49F5D008602C55C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b7a3068fd49fc8e5d0ae88d1031b4353646408109e23dc8c5acc416ec0cd7585
MD5 ef37b60974194f6a2bd722365599ce40
SHA1 69f0538aef22335b9e326edbee2fd6e2d1951f80
SHA512 ab8609ee738c2f4fc1e2f1728422459bf6ae638d3bdc876bfc4e02573038710c477348b9accffdcf0531d7d273ad7fd6f3ad50f8ff923538600086c5dcd0b2a6
TLSH
T1DE311E1A19D61B57F77BD7B6D6FA052BA6B2FDE77620EF0C00A042080C257827881F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 29f50b974212271f59e7f92585cad0657be536a81cdb97615122452eba6e55fc
MD5 3479dca088848259c25ecacf6b2a59eb
SHA1 16943f3add8c90a4dfbf6f88decbe80eadf2eee9
SHA512 36971bece4704404eed90cc6e04eba93445674f53cbd6ec0a4fbebc27706b6602c4ab4d82c8dac868f195bb21c44d0710c0a353e42ff88f10e786d2177353ffa
TLSH
T1C611EF4924D12756D372873A81A31721C3B7BC03FAB49F5D008602C45C49203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 0c763326c434f69485970eeef5b75c864345b85e33aeeeac5666d8f107a8a0e9
MD5 de0313d1f17fc3790dc8070ae786f5a3
SHA1 22e1baa1aa23e1e4c4c520d98828fc253ce7258f
SHA512 14934313d8062a5c12f6d0f9bfc75dc620ee118fe92819121d37e57eaaee79db4dfe19bdcc411892c644d88f96c22ff4348f92797997d6db17c96fd1425ba2e7
TLSH
T13211EF4924D12756C372873A81A31722C3B7BC03FAB49F6D408606C49C89203A965FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a6bef3b97b9709688784bfc0cdedb90f62484f4d9c98694f9f287ae2af875702
MD5 2b4f759eebefef7b4730987d6f35aedc
SHA1 93f3ba6ca0a0fdaa22398ee55463c6184c13e1fb
SHA512 4d26d620cafa762921ebafe2cafc1e56487bc2055def713fd0d29a43f7e2b7c04402cff4497a0d727c39a6a86fd8c8f227524016b0461e6cde070e0bf0eb1936
TLSH
T10D31111A15D51B57F37BD7B5D6F6052BA6B2FDE77620EF0C009041080C257826981F2D
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f1887e2ff386db48497e0ce8c69bf8e7abe921bb8dd4787e6bf45665fe467fa1
MD5 e29ffa081923fda3dab51fc38678418e
SHA1 a75c994b1541021b33a7a49201898e2869eafacf
SHA512 9fda18bba859e3ca2416824954d458b8ef21cc67719312977e8f2b88934cc96fdbf9a9cff09fb579beb1e569925dbec9bace5fcac826c9e17a7464e64bac7ac7
TLSH
T1EC11EF4924D12756C372873A81A31721C3B7BC03FAB49F5D008602C45C89203A969FBF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 2.6MB
SHA256 e4700653367566d1a38f9b15296a2a915f11faa3787e9bf26b6377621804626f
MD5 16f9495934d59a90180a1a1c2cc3f209
SHA1 3449be3af7e177b0bde9687aa645cf46ed3b8f7e
SHA512 f8905de11e5a479fdc37d5e497c318dbab1a6e745487fee4c0b638c823b2f89048a393d5ae7edfb58e7d4ddffb777ec8ef0914f258440bcf8510355c0211166b
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MC6:eEtl9mRda12sX7hKB8NIyXbacAfurQ
TLSH
T1BFC55C64E610D8BAF3D6E978540E7F291CE17D120BC22D4DA49DAB241FF0EF4E5B2294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2301830172-776172150-2531349243-1000\desktop.ini
Size 2.6MB
SHA256 7b691810773c8d36292569c9c689a17bf30c8728ba51c0a227932fa5a4c21349
MD5 9f1e068950ba2c9696888409292f789d
SHA1 439cb5622d4d39ff0c3b6cbeb1d75cf15ee78443
SHA512 9cdf5a9df5e4e6ecb6af7a957aa7b437b31457c71c28d3011f1cf257bcbba12cbd9a3808c10d7def5d3c380aee44c2836dabb37e82c9c82c82f94ecd6bfefcf0
SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCJ:eEtl9mRda12sX7hKB8NIyXbacAfurv
TLSH
T134C55C64E610D8BAF3D6E978540E7F291CE17D120BC22D4DA49DAB241FF0EF4E5B2294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2144-2-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/2144-0-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/2144-1-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/2144-44-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/2144-42-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3456-45-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3456-43-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3456-55-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4456-60-0x000000000B500000-0x000000000B6A4000-memory.dmp

Download

memory/4864-8-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4864-46-0x0000000000400000-0x000000000047B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads