stihat | 7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
Size 929KB
Sample260831-e61vbsdk61
SHA256 7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2
MD5 0730baa7bfeb3d9904ac3be3e602b524
SHA1 cd727bdac0df6eed637bc59bf292879dd8a3e4b4
SHA512 bad320682b336b8df15d7c346ecc3314ed8fcb11af8137018d839e7c875b861304329e112084b2ccda2d52a3b2cacb3a33f401e5dc1a3618e8a7f54829b73861
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/Kz3:TEtl9mRda1cSS5GJ/Y
TLSH
T17E15AF26B290C832D1B3157C4E5BE6B9583BFD512B9469C737E83E085E38BC1B439297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 51 IoCs

resource	yara_rule
behavioral2/memory/4448-0-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-2-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000a000000019cb8-7.dat	family_stihat
behavioral2/memory/1260-8-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/memory/2700-43-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-42-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-44-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-45-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-48-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-59-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-58-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-67-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-65-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-77-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-83-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-84-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-93-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-99-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-100-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-109-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-115-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-116-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-125-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-132-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-133-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-146-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-152-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-153-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-162-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-168-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-169-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-178-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-184-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-185-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-194-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-200-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-201-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-210-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-212-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-215-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-220-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-222-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-225-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-229-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-233-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-234-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-240-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4448-243-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/1260-244-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/2700-250-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
1260	HelpMe.exe
2700	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Z:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\M:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\P:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\H:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\J:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\K:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\N:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\O:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\U:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\W:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\B:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\T:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\A:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\I:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\S:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\L:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\R:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\V:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\G:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\X:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\Y:	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened for modification	C:\AUTORUN.INF	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe110000005540a9bbad0fdd01abb8098fb90fdd01abb8098fb90fdd0114000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2324	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2324	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1260	4448	7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe	89

C:\Users\Admin\AppData\Local\Temp\7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe
"C:\Users\Admin\AppData\Local\Temp\7f09ca457820da43aa17b307ad05a6f67f5db1cb3602e335159a9f17eebb37a2.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1260

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:4752

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3f2bf2e56391f8952d258952397ef512f01fc7a877b447e2a7101578381f3b7d
MD5 ef19e3107554f4dcc405d737ad97699c
SHA1 91f49866f2a9e8610604354ef62820613ed940eb
SHA512 839817ad171cd48c4b81fb9ed1dc84245f9dbddf345c27dc92703e1db6eded1051b89484095bad1645b1ab3f2691a85826277489a7ce91ee11277b52a64ecf9f
TLSH
T1FB11EF181D812B33C3E28A7B5163772193777D03F9A68FAE008553811C80251ED04E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f17ccbc627e2cc410f3615a3243c1e9754681583996aa628a84080f11a8f5b4d
MD5 2f5b180ed90d0cd214c3f48bbaa2755f
SHA1 5a14b7d3de56f7beda8e3323279702a6e46994a0
SHA512 ac33c5e50b0eb47f10a918dc715190ccd6e0296f746ef256433a3db22631da66c98ff21dcb720f1996aab4f9c13093c869883345cdcb03ff717c1c40125144bf
TLSH
T11621C0399DC52B33C6BBCA764AF2266ED735F813BA565F1D004243490811B522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f1a5734395ac70cf50abaeca34a33786ce94e306e8a4e7eef444a5dc4fa189d4
MD5 e2a33d95bdbfc6a0f31717cdd2db3a06
SHA1 3897121591cc6ab9f659b0ace854229ab35b1af4
SHA512 bac6951b04579ab30079f90afdcb3fdfc2c61fc738f671b5b6ed19656b8563296d7fb2ddd14188b28fc694b026841f7f6a30bc7f996303d224014558fd7b836e
TLSH
T10011EB181D812B33C3E28A7B516777219373BD03F9A68FAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ee34f48280dde8d1bcd7a37273d08e4aa377f55bf69c12064ca1fb30eb8f6db8
MD5 c716d54c688f6c4cd1a4459f035c6b47
SHA1 5cc969bfcabb6b044ca3324879ac37df483e087a
SHA512 e5cff22f8aa36ea3e45dd226c10589141f2e97da57110632e8c397b79ebd10cf18d1e8552a12228b7b1d80ad9f94f660175a06dee99ddaa8a6cab65f90913106
TLSH
T14E21C0399DC52B33C7BBCA764AF2266DD735F813BA565F1D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6f578fbf5321aa95c45aace5e001644ad2d5bb15dbee92c3526ebeb6ff697e27
MD5 125f1d989dc108994a08dd19bce1e6cc
SHA1 119b56fc99bc046b58a1a5f7aee975ba24d7378b
SHA512 719a79bd328a0ba40d125726054e265e599a7adcc9e53c7ea24061d519107db823ab90a9e42120963e07d4c5613447d0e43f24d2f5e17f937f8058f0108b860e
TLSH
T13C111E181D812B33C3F28A7B516777219373BD03F9A6CFAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a1ea3c4814cdeda3caa515e240c5e8de3d9f2ac3534bb80c30fe0ce72edab000
MD5 0ef7cc861c89b93844e88115302e7001
SHA1 7f3129529dc7355d98e9381e93b69f85efbe435d
SHA512 e593f07768f235a85ed00201a186ab47941d544c13cec09146e413877c7c9d57cbaa8646463b49d9eb8116938f4c89758fa0210ca090104d91fa3b9fe39bd5d7
TLSH
T10F11EB181D812B33C3E28A7B516377219373BD03F9A68FAE408563811C84261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f63ae18a0924bb2c87df745b4a7e838176d59c2dbeec5c30d46c9ec6c5fc29aa
MD5 5825eabb1c0402ad03866700e09fddf2
SHA1 6b34559b94a19023a5400f71c590ebb2149662af
SHA512 b71cddeea44239701b774d52a2563bbd6e4912e3347548abb08fc8a30c376276a5a7b7c544cd72c892c5da2e878141cfa1fe8a753222b371cad6e4941838b391
TLSH
T1BC21C0399DC52B33C6BBCA764AF2266DD735F813BA565F1D0042434D18117522EC5F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 36cbe1bc83b3bee671159d42021f034c7c7e06a73ebac2caef0efdc439f1ae3e
MD5 b9ed7f82c52996c325f9fdc38d7535cb
SHA1 86b2a77904427ab58cb3c778f2c8994779cc6866
SHA512 8eadf4c1de2f8fdde986aa2882e40e12433e0e801197f8414da3b3b3b6935bc074b76e92225149e142f526db503b06cd89fc13d4281e954c5bdc78af218ad99a
TLSH
T1A111EB181D812B33C3E28A7B616377219373BD03F9A68FAE008563811C84261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a23048ee397d31b50941f87d52f3c927e7ae4285cb782d6b04cbf5ce6735fdd2
MD5 57b5b6d15f6cbe57f3ebeb2b4f906e05
SHA1 59264d3704681478932438f9c193a030970f757d
SHA512 d42fb2ec3061fc834d16495e0c59e8d10a6e9b3d64b194b3d2bb25c6d91a7f726f024ef95541b4842697445b91824004ed4a4fa5f400310033ef40768293935c
TLSH
T16321C0399DC52B33C7BBCA764AF2266DD735F813BA565F2D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fc2396a90771e1e1bccd3aa38cc5770b01ebbca21c0500f4a52e49dbd64a6761
MD5 70ff62f633322326f8853e8bad064337
SHA1 b4c70749293b19453ad4655d0d79f6d93c8697a7
SHA512 6067ece3f0c109b0ed25e19ed27445bc9acf11f004d09e09de88196c9b3f6de922839d6cec1679ea63e9d2f7ea24f5b6de61b9671c700f471cc63dc3c4e31b84
TLSH
T12511AB191D812B37C3E28A7B516777219377BD03F9A68FAE418563815C84261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 02070ca4ff7223850ce9879f7e61f46ea6c49a25e7397389e583a6d41514ba7e
MD5 c0bd5819f8ea0dbbb03b23fcbab2149c
SHA1 c5765892d7bb68e3fbfb88f0d1236d6d60d1a8ee
SHA512 8ddb7ce847317f72126f931263b60973c03006c4459456d02662633f62395e09a1b07dc5c07d8a7ffe88ca44d2505ad0f2a44d9b998d280d2c57d714413e3212
TLSH
T19811AB191DC12B37C3E28A7B516777219377BD03F9A68FAE418563815C84261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f21bf6f2af22f3bbc135d56a00277d09379dd12e13edc2510aaadc95759bfacd
MD5 346207a75f80faeb3d16a55b4d3a891c
SHA1 cbe07d717b08a892ec6d4bdc47ae840d83d71e4c
SHA512 8595ac69191cbbb0b41a75ec74d1f199a93eacf498da1b58a2121ac3312aeec90458afe9c3b40b65c558947a42351864dbcd0d46d494d0fdcccf322c654a28bb
TLSH
T1E911AB191D812B37C3E28A7B516777219377BD03F9A68FAE418563825C84261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0d9674e15be0918481760b000620d8347f4affa18e1685de1c990726b347b4d7
MD5 980f82da8e57c62cc146db5a5715de10
SHA1 78b4261f0846235c7486610dd70eb84b5270b117
SHA512 975e3086977d5a62a56c1a1277bd59af43bab5d516f64e9f5faf655711cdd79978672c514e942a5dc4e29e46f3140bd0bcd773212038bce254955f10a267b1dd
TLSH
T1B121C0399DC52B33C6BBCA764AF2266DD735F813BA566F1D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 aaeb535976562b6a2885686e88daf7a954fa31da7fbef411dbbf4fd615ffd34a
MD5 35b4ce07dfacc3024b68ccc5db1c2362
SHA1 09c3582c8b3bc1eaeda417426f12dd06b140cbbc
SHA512 0c845996d18a17b5a885e7b2e1c3f55dde743fcd1c976d7a57cb69d84bf0840dc1f51a60bacd70b202e7efcd32f4a37f3c39a79bbdd1456fb9a91d0a20e2fab2
TLSH
T1A0111E181D812B33C3F28A7B516377219373BD03F9A6CFAE008563811C80261EC48EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 1c4b9b54d5698741e1d7a2d3ccf3b1a72f55b93b4763abd997452a36ae11d743
MD5 3bc772d5130496414d8bc1c074d95e74
SHA1 d30e17ce4e28d180505a8ca5609acbf90aeab978
SHA512 ef3c84166462a179d91b2562823bf9568e1b7cc5e976bde3f1deeb30f8ecf8cbe00fb7a6fe293a87fb85972d0b21515a4f468678e5ca0af51ea2bcd40edf1fc3
TLSH
T1CE11EF181D812B33C3E28A7B5163772193777D03F9A68FAE008553811C80251EC04E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 69a89f9607a507cd851e72b21967b81aeefe23e68898bbbf79bcc496fb7a1b3e
MD5 431b615be3d1a995a57f9db6bebd09a3
SHA1 37dd9f7341b20577c8c0eef1479b91a1279c68fe
SHA512 89f7a9e149e7ed665b1a72bb51a350d5813a8c312c9d8a5e7e40ae1804d259c53d6cb2ce873cf6e0652a88857faa343ec341400a39eaf4eaf6e42998b5856dc3
TLSH
T14021E0399DC52B33C7BBCA764AF2266ED735F813BA565F2D0002434808107522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ab859c8568ef330fb2977071e982e3f401051c47b874ad45efb8498513bf7116
MD5 5bf76abc8386bbfec22ff91972ae0129
SHA1 a54b3ee91aa2e28156df6bd8db9817f203326a09
SHA512 fdb77a48fc20ef4a6bf8c9c46031eee25ebf4834e735b4b80adc5fe628e2dd4acfc6ac4d243a70c989e8e946fe34288f6fe92d4e526d24290323aeb86f886472
TLSH
T10C11EB181D812B33C3E28A7B516377219373BD03F9A68FAE408563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b4dd6b77c58b278a3dae901631ef1cd6e528ea161e678d378a3832dd5ae4913c
MD5 ee585d977ad624b562c9b282556d06da
SHA1 239df7dcb258dee95360986390fee808a1c35ea3
SHA512 814777a5b3230bc50ed6db83a6041b1f5bc9cc4b3d199b7f08c3b348d25ce5f2f3b048d437b20ff0faaefeec92d8ac9179213abd2e056c47f8322f2a8957bbc6
TLSH
T1BA11EB181D812B37C3E28A7B516377219373BD03F9A68FAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1628e8c587444251021853ac2c505aa7e034ab2b934c20508074d7822228aae1
MD5 fa5c6400d4599cac7aafbf891ca691b7
SHA1 fe29909cb57196847dee4c64d41d17540cf3a8a6
SHA512 758b6e8a8a1f4422a20b3ba51530409cccf67548630ed196ba103530811193dde66cadef011479b0dcf7400e134ef3adef858987515ae96fa6c71046dca1d9d7
TLSH
T13E21C0399DC52B33C6BBCA764AF2266DE735F813BA565F1D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 85c01b7965ce45c4aa4a87a224d5f6b145baa02b525864c0ea86508ee1136cb0
MD5 8fb3b2fd9cc1653e79987de1bd6c0860
SHA1 b65b7604d8660a3a1219244fb8dea56d6bae7d1e
SHA512 495037e25eae304921728a240e46d458641f016774fc335b0769cfce3daeec841dad704fab7be30effccf5e8c784dcb834454ed89724d6939fc74589a2542db6
TLSH
T1DB11EB181D812B33C3E28A7B51A377219373BD03F9A68FAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6d2d991b4cd59c94b0f20154344968bf9ac4f4530e36e2f88f2ff6b6271d0f18
MD5 f5a949321de8c998362a7ba7d020a4a6
SHA1 545b62920db752be3c61d7e5389bcc8a599f5e34
SHA512 e5936528f6ca91c9e6d3dad6c3ba32354ed507bf93988ac0414b238deff9ad7dcca1220771d4abd67d08ca51a1bb9f0a148a97094d84aec815108c5e2c9aab5b
TLSH
T17C21C0399DC52B33C6BBCA764AF2266DD735F813BA566F1D0042434908117526EC5E1F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ca209534040ab4b2ea366b94ba07daf25b5d54744ecbe042fbf1f1b7eb9bd4c9
MD5 476bd0e24e11e9b4b36c7b4d09b384c7
SHA1 12e85e3dd61902bfb915efa0a99e94022b0ba623
SHA512 ca4d2a2ef2dfc3740fa0eb0450c598ecbc7ea64bf27b8fa06b7d1196fa2aa3bc28389b11f52a6336b5d2b9a2f09fac7f7ff41cc6c177f2965f9c3507d86077ca
TLSH
T11611EB181D812B33C3E28A7B51A377219373BD03F9A68FAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 12f98d7f561d646c76491d284530ded44da8ec45fabe6cdfa81eda252c576046
MD5 b925dd8eba22f0e732236e2dd1f32d34
SHA1 7503e90d6494dac4bb91ec83af4265392f4d4bdc
SHA512 05b0a191217a59fe5c63224cf002ecd92d7ad8b65e44b74ade13fc94b45124017d2ae8880cc3a31ff0120758df6e2cea135158f3a2c5ea2d7b6cf4c1ecebf23a
TLSH
T17E11EB181D812B33C3E28A7B516377219373BD03F9AA8FAE008563815C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e2ce20d7bcae21a8218437313cdb4f10549aae70cadf6417d05efed28b5dac61
MD5 e53aed3527f4a6fb0861871d6bbfc0a0
SHA1 cf8da42913a40ebdf2d32230f2daffb473fc17c0
SHA512 103418d46aef04e9560465e2d35dac984fe0331059772771af8f6a7c533ae81753e7f3c6a479ce5eec44ff12e47cac6334cc83fd733bb92ae0fb8c8e58cd6a40
TLSH
T10821C0399DC52B33C7BBCA764AF2266DD735F813BA565F1D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3ddf57709021abe155db9c8777673f90db357ca331d73ba3761e87ce888bbd8c
MD5 9de29fcaf94f2d8b5a150780d4e251b3
SHA1 67db428745c41f69a409c4778fdd599b60ecef65
SHA512 31b215e7ebc253ff21c08d1667df9221ad119322ef4da7821ed1bfae04984a98e0064e9089d1bca4ec9952ad6c018dfdd15725540adfa91e070cae54b62a9bf4
TLSH
T10C11EF181D812B33C3E28A7B516377219373BD03F9A68FAE008553811C80251EC08E6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 af4b7460bdc5face3356cef91ccd1a2b4296c003ef9c5679ad3649ab8521ad09
MD5 a250336f905a9073abf78a200be60152
SHA1 dc7bc89dc99e84d9d16d593f59b4fc884239bfda
SHA512 d2a9dcdf68493344056bd2de32c122c52049384d99d31f3a459cd1422952bae4fbfb2068d1586c35522918cbd79285198a0daac2ba00eacf3b9d2bb4442a8f5d
TLSH
T1DF111E181D812B33C3F28A7B51A377219373BD03F9A6CFAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 57bae364e860c04ab5bf7e2a5f9f95f3767da770800043887d3bb41c4aadbb3f
MD5 c488f8ec33ef53a72731707f27bb1b7a
SHA1 25fe71609430cd61cbc0dd75fa6d18fc70d6feb6
SHA512 738deb907db6d1a8e8d970426d0379b4e6b4ef978823f92d4b58dcd692d1c67ad663e85e5d766210c9346d58bf1dd682c315a7abad410a5e50421247c8f6514b
TLSH
T11E21C0399DC52B33C6BBCA764AF2266DD735F813BA565F1D0042434908117526EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 ee53dfdba85b2386b7e9fa27a1649f7c7745786306ca3e0f1c159936a1bc7f47
MD5 69b7cee246622e55177add3177bc63c8
SHA1 e3fdaba9d34c481f9318a89fd459fd8749d9784d
SHA512 2c0a3c495fd8b3ebad220b85d8cd97fa8e0aa31e04de1737a0596c73e288cda59b1f8b32f166165f01aaf9997354d96482b973e6d5cf9533a906c8ac530cd1d7
TLSH
T1AB11EB181D812B33C3E28A7B516377219373BD03F9A6CFAE008563821C80361EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a707357cb3089a876f65077f666df3dcfae10f5cb15b91d9938758f472f694e6
MD5 7ccb802802508c4ac2dd3e1ea4ccbe1f
SHA1 9fef4354cc92b148496ab3e78d3bec65d99ef533
SHA512 95dd6fbdfeeb48f27d22e48d7fbbb30b8ecd84468c05bad951f88f6de210b7aac0672f1f623784a82d32582c70b12ecef8543a8ba8c16709052a655462e68a70
TLSH
T10A11CE191D812B37C3F28A7B51677B219377BD03F9A6CFAE418563815C84261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a881167be13a2f3e211b35b522cc430e9d38e3f3476537f3007a9ca904e3cb68
MD5 3a0304afa21e280e5ce330b98037ac43
SHA1 5efa052be296ef87d8b33c0d6860a0084a481cc1
SHA512 34ddec20bebf701832e66d26c57b6dcd0d1b103edde41ef80245731b82b7485d65bdb76aef067a85d3fa790a1289eb1038ed400a58d8ec56f5e0af054cf4625c
TLSH
T18521E0399DC52B33C2BBCAB64AF2266DD775F813BA565F2D0002434808107522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 a9698292a297b5215fff767f8c6d70c841ce1348486bd555d66e132057fe2219
MD5 94b796bdfde5c5bc494264ed134db9c6
SHA1 b2eea951ec5d2e4298b158ab04f726bbc063fa00
SHA512 88d47ca852ac2a3a43df91e27c0464502ac508a8d0866c6149e01db564179e86e7b98defca753d76f58ea2bf9056761241e1cb7d9f3c62d48e80a8b9b6ca84ca
TLSH
T1DD11EB181D812B33C3E28A7B51A377219373BD03F9A68FAE408563811C84261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7d442a1a0678bbda223cbfd6ea163567dca9dc607350d9229c1373c8baab1804
MD5 c5ee49dbd033a52f2179bb7d14a56e23
SHA1 782efc4f625691f78fa44b774aa2523d0074d866
SHA512 b56a4e3b9d900fc3331b8b3ef8a154eab43055e36ccbccb593cf191f854142554393cfdd71421df30dc09d1c1211f3fe2c8681229e4f2c73d21bd40a1107df09
TLSH
T15021C0399DC52B33C6BBCA764AF2266DE735F813BA565F1D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 b511b3af683346e13aa05fc0a92f6d7e335b8bd0794057e783b46da85cfddb98
MD5 7378b5834cae84c4c091652ecbe2ae00
SHA1 2f283574dbca250bef8707638cf974cf0c838dd1
SHA512 e46a881e76bd25cedbca689243e62f8a370513f990625fb35161a24e75a4be9ee3b1f07721d10817a2305060b2874ceb8e9e489f3a55dfe44f5e9706713a791e
TLSH
T185111E181D812B33C3F28A7B516377219373BD03F9A6CFAE008563821C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 289e89c0bab7428537ecf865aca05fcbf61740affcef3ead24a15d724b6712f8
MD5 2245fff47c6b295fda6e770eb96784ab
SHA1 0db8f3046549bdcd534f3a7ef3d8a80179c88e4d
SHA512 661b7790bddc7ef6bde891097c304f17d5ae8967edd80ce8f19ad9a24c7aca0ad0af988590a16307aee7da935c1c20df7ddba2c4b87a95100156ce4f5effa63d
TLSH
T1DA11EB181D812B33C3E28A7B516767219373BD03F9A68FAE008563811C80261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6f53eb130aa9e17299a9720ede083c3d80d34bd19e142ffdee1ad3f860a0aca0
MD5 ee507d1de57c199286d0ddf41b9ed89f
SHA1 07c0af80304ece680cb8c09f5ce0d5344190b02a
SHA512 f04fdd573326ef501754039c4fad305752a54d5ca08d0b604b97d2f8bfe2f5ce559b7e5ee655247178c4b1a7c7fc6575f81145ea1f83fd8fbfee901ba4a5beab
TLSH
T12321C0399DC52B33C6BBCA764AF2266DD735F813BA565F2D0042434908117522EC5E2E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a0b8c7d4759446c4c81fb36fff72f3c51463e4d1b86d3d85a22725c2059a1020
MD5 764fc9777f128ed770c566018e07fbc5
SHA1 caa180d6cc4cf877687248ec0e5545c1a6adc053
SHA512 a8c6d6a017f961759401629ae4abeb25a3fccdeb927e2108cba812418a36dad472bc73eaa8f75c505c0d56a3ea207034bd9f449a581d085dfb0868ed45187401
TLSH
T17921E0399DC52B33C2BBCAB64AF2266DD735F813BA565F1D0042434818107522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 fe94c76b4bfc9d57571ce48d8f90be629e022a298ed21f48c034cb0da27d6e56
MD5 05b6ec73b3109a982e5f5a2cb8d1a483
SHA1 53accaee305db6ccd4f8694659e16b978b2536ed
SHA512 a4d59b6e6b70d3fb44b555b5dda4b3ee0e4a416c261dd4d87fc82e44e99570f3ac3539a97be404153549aa7039b77f8716830ead7c7a8c8d6bff5af26f66c32c
TLSH
T13111AF191D812B37C3E24A7B5167672193777D03F9A68FAE418553815C84251ED04EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 43cd41479d9815715d32472696c99a7b21786f66689597081b5f9cb98c2e9a53
MD5 97d50cf364b03cd2ec1e57a2b1d9a3d9
SHA1 1507f01cb4e71744600be9727458cb5aff361b45
SHA512 50ce8e29758ff2aa1d3aacdd190742bbef1e5c549e0fec46c5b58798ce847289d2ab9e58f782351afa61ed8910412eb61432663c0a149c58a4e1280855bb70fe
TLSH
T15611EB181D812B33C3E28A7B516367219377BD03F9A68FAE008563815C80261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2f4c95cab2b041b29011cd0f3498732ddb5639f9f4aa9b58e197d1ee136197d8
MD5 98194533dd43c55d77a030f49bd828d7
SHA1 0eb152d95c5ebe277b371bdb91088edf61ffb812
SHA512 fd98209a31941f108e78c1e366b0e3353cdc9a5a5b63943148392ff9ddd3a6d989d5411943efa6996d803b953cbca41f6a7043bec32cf5faca36029d411972a2
TLSH
T14B21C0399DC52B33C7BBCA764AF2266ED735F813BA565F1D004243490811B522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2cad0b8f2a540350ace7cc2decbcbc3ebc37d839a983841c8d9ee557d7f2385d
MD5 106fdf1a762ef82171d917c6b112823c
SHA1 abd469b32e170787bcdb871b39f4cbe31f8eec4b
SHA512 05a15f1951b18e496c90eb1661ad3266411821858e7a66a9d39d373c4b0ec59323d40b3131ff2ddbecbd89bc27dab0c20cd1bb4693a29c5bd19c09ab805fe3c8
TLSH
T1B111EB181D812B33C3F28A7B516367219373BD03F9E68FAE008563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d312a0e9ed969e20b8980fa844594f1314bc3dfbb6d7aef3342b7bd87891d054
MD5 7307ed444c6e347baeca8209f3deab71
SHA1 f2dc1ab8b8a76c9531106497dfc0bea979800169
SHA512 1b5141baa1b586f17bab0f2ef5672c55ca0394e4f17723cd7a428f349bd4fa3315a8df74f294d41dc80f0b5110677cc5a0e79eff24268bc412463f75953355f3
TLSH
T13511AB191D812B37C3E28A7B516767219377BD03F9A68FAE418563825C84261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 645a5012b6a69ce8d2024aca886df9bbc0e34f1b7d9356219233741d06836514
MD5 c35bed762fbb9428f5a1f9b0a9e4fd39
SHA1 817eb5d1d192cb8a961288787f427f634a612b24
SHA512 e441b9a7ef6085fd480c4d8f9ff24dbf1560bb6ff9a56acf01a602031df3bc58690a5a060a958c1b03efe0bcf1aa041f5d9c597d5932d20e75125c3c869d29f6
TLSH
T1CD21E0399DC52B33C2BBCA764AF2266DE735F813BA569F1D0002434808107522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 81ad87b5d78244c54b8b4d82216f104caf1162c2fa1b490cfbea66a41cb48467
MD5 57d02c759225e0e7d9850633aebefd96
SHA1 d6ae1d73732e4251018abd7aaafc8163683fcd09
SHA512 daabbfb95a22e5033fa173c5ecd770bf42c7269eb781ff67b878cff49fc6b65f1c29e0503f772d7ab9c4b170601d3f8b3e602ac123494a30b22c1807d903e210
TLSH
T165111E181D812B33C3F28A7B516377219373BD03F9A6CFAE008563811C84261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2074b8965e201615abc5d503fae263f3495b8b0f61439775ef6203a278524f0e
MD5 88ddafb86fe21b6f4e39dade183eefa1
SHA1 014867730f7a1f2ee871255ea72c88aa9e721866
SHA512 a29561c5a836f8cd917677479cab19d444c5dcce78a36c5b406f277e3f55e451875800ea553385957e5de5b4cac2d32d54f49bc6e362d768d8c28370738b9fd7
TLSH
T15121C0399DC52B33C6BBCA764AF2266DE735F813BA569F1D0042434908117522EC5F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 0317a1fbec40e7eb749b8058477878cd7a470b9481fb545e8acdbb66b23216f9
MD5 9ef347eeff9ead319112ea37e6523c21
SHA1 4e75c8258efee623ebd76a6e553193e231336818
SHA512 2844ef3aa634abe18bce3e3362b28be76710f0a91ece783c37bba055dea8d0927f9ca9bb0ad23e66450f7264f5c8c9421f857fd72409bcee7e2978a0fbb6661a
TLSH
T1A711EB181D812B33C3F28A7B516377219373BD03F9A68FAE408563811C80261EC08EBF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 57c0e3f00aba6883826475aee53b49b8d1780bbf6c75dee9e578b6b207b6982f
MD5 33bf9ce6134cfb73a01fea4af8512348
SHA1 2fcbfe9bee85f92db62e322519e3f2c7ae3a8769
SHA512 18d972d3caf7cd3d837f8123d391cfc8fc529e0df17e1e44ba59e00e2a93c628bfb7a00735ad4411964e1274b2b4d7129787bda360a88cd18c7c87d44f26a239
TLSH
T14611EB191D812B37C3E28A7B516377219373BD03F9A68FAE018563811C80261EC08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 561b2225eba4de19e92ed874a939854f5a05c4b98c11b4183bfbf9029eb3e3e1
MD5 87e65f8e384365e9ee79fff6dbb556dc
SHA1 7d52348eb61a6310e492756ee7f608055d67b71d
SHA512 142480bf11c1e35de2d569365cf8ebf182aec18065f01b4055dc965a851f511562b2a54815dd89962e40a9863a241ad91d46b9f1be30c45b577359ce6ff38c5a
TLSH
T1DD21C0399DC52B33C6BBCA764AF2266ED735F813BA569F1D0042434908117522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8d7a3a986240d53f9338f2d4fd548cb07ba92bca8cc54811d9cc1a1b02a6e286
MD5 71dff7529df65a49d5d23aec396494a9
SHA1 a5ad2d1fcd9c10da758710086195ad843575dfc7
SHA512 eb3a5610d678612a309ab1bf5e8424195530b7325b6456bf55efe75f01a6de32d08db5c654e17b8d7a74619352a4a5b33ff3de0b66287867f10e28b69a7d94c0
TLSH
T16621C0399DC52B33C6BBCA764AF2266DD735F813FA565F1D004243490811B522EC5E1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 d74122fc3c59a2acf475acb7b9ae7a76987af1dd5aeb60700f886e62e7690ce0
MD5 02a74a6050d011df9a5db8f3521fdc5e
SHA1 42d2a4221f889dce0f29a45954b3ea793c3a44a5
SHA512 2924e7b23347b45d075dcb9edc478646f54533d796a1cad44068890aac6876ebfe5e3ef74ab3b8e096b55bf8df7122a2cbe611839511c4a442a0b03abd911743
TLSH
T1C611AB191D812B37C3E28A7B516777219377BD03F9A68FAE418963815C84261ED08EAF
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 928KB
SHA256 2e21b5e1dfbe24b2f75e6504b510874b1697051ec3fbd976a02887bd213c0da6
MD5 e727fbdbc25add8c0f5f1b46d6e1439d
SHA1 62d2cd6e700d11b93916e85be5e49b6a52493763
SHA512 daf79863f03f3668236c9d986cdc97d55e9905425434ce412b29df28631faa387135bb4038f9309a5715c64b346fa54691aa8f4957fdb6be8cf9d0577d6f8361
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/Kzc:TEtl9mRda1cSS5GJ/h
TLSH
T15C15AF26B290C832D1B3157C4E5BE6B9583BFD512B9469C737E83E085E38BC1B439297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini
Size 929KB
SHA256 0df7a790c34e1048b4dc6a1a4e2807c4240eabff90219ea6031743654f7b0042
MD5 b993162ab47c8c675ef0632c0d153655
SHA1 5c593a295d263c7b2b591360b7f52bdb8e9e3147
SHA512 96efff476c528cbddd5fd4e88ec2fa66d42212ed75d756eefaa01e065e59f973c4de525154d3df139099dc730167da3b65a71a72d5d56d64faefbd7cb01b34d3
SSDEEP 12288:Zp4pNfz3ymJnJ8QCFkxCaQTOl2BU866px5GpX/KzF:TEtl9mRda1cSS5GJ/o
TLSH
T11B15AF26B290C832D1B3157C4E5BE6B9583BFD512B9469C737E83E085E38BC1B439297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1260-169-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-153-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-133-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-84-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-201-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-8-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-225-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-116-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-215-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-234-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-244-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-100-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-185-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-45-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/1260-67-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2324-62-0x000000000C8A0000-0x000000000CBEC000-memory.dmp

Download

memory/2700-146-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-109-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-162-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-58-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-59-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-250-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-178-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-240-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-229-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-93-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-220-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-125-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-43-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-77-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-210-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2700-194-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-184-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-83-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-132-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-2-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-1-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/4448-152-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-212-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-42-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-200-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-222-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-168-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-44-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-233-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-115-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-65-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-243-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-99-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4448-48-0x0000000000400000-0x0000000000477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads