bdaejec | 047e138efd0c8dbb52cc949ad66ffc45f4a64eeecd7d35fc2fa473495785fb1a

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
Size 1.9MB
Sample260901-273rmsfc46
SHA256 047e138efd0c8dbb52cc949ad66ffc45f4a64eeecd7d35fc2fa473495785fb1a
MD5 f78165a4723c678c3e45595d77e73588
SHA1 88515db4abe95ca75b1008bcb4894a4f16edc549
SHA512 0c84ab0c616d2db4f580dc1e648b50777cd8a98111f341a7bbf467f572927e685eb1faadf36c07df778d8fc9bb525621807d9218242e274093c9509d6ceff13e
SSDEEP 49152:LnsHyjtk2MYC5GD0IrWlpnxGNbreCSLT:Lnsmtk2ayripn+r
TLSH
T1F795AE21F7A2C137E57715B54CBE86AD9028BA600F34A4CBB7D81E2D0E756C23D36297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Detects Bdaejec Backdoor. 2 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/2560-144-0x0000000000270000-0x0000000000279000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/1736-146-0x0000000001000000-0x0000000001009000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 5 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011374-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2560-5-0x0000000000270000-0x0000000000279000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1736-76-0x0000000001000000-0x0000000001009000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2560-144-0x0000000000270000-0x0000000000279000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1736-146-0x0000000001000000-0x0000000001009000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000011374-4.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
2560	QOPtqH.exe
3688	._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
1736	VfqFQL.exe
4736	Synaptics.exe
840	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	QOPtqH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	VfqFQL.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	VfqFQL.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	VfqFQL.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	VfqFQL.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	VfqFQL.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	QOPtqH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	QOPtqH.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	QOPtqH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	QOPtqH.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	VfqFQL.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	QOPtqH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	QOPtqH.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	QOPtqH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1008	cmd.exe
5060	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3524	4736	WerFault.exe	92
2772	840	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QOPtqH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VfqFQL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3688	._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2560	4428	2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe	89
PID 4428 wrote to memory of 3688	4428	2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe	90
PID 3688 wrote to memory of 1736	3688	._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe	91
PID 4428 wrote to memory of 4736	4428	2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe	92
PID 2560 wrote to memory of 5060	2560	QOPtqH.exe	101
PID 1736 wrote to memory of 1008	1736	VfqFQL.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\QOPtqH.exe
  C:\Users\Admin\AppData\Local\Temp\QOPtqH.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3cde5018.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5060
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\VfqFQL.exe
    C:\Users\Admin\AppData\Local\Temp\VfqFQL.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\53cf1482.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1008
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 520
    3⤵
    - Program crash
    PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4736 -ip 4736
1⤵
PID:2872

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 492
  2⤵
  - Program crash
  PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 840 -ip 840
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 31KB
SHA256 d030b05760b8b36c9c67faccf5e230a66cb63d17bb232cb0b484913e25aee9af
MD5 beaf3810844bf7e4fcc862143e124902
SHA1 cf10a73a6dea5be24372b3831ea56f986da55d90
SHA512 99a27376becec694e3b337858f24d9a53bbbdc31c6a0af415f2eb8bfa0c0a80749fa4d7e69fc1f2c76a70cb0945f8d78370d663097f9bfce8475c2f6593f4cc4
SSDEEP 768:6WQ3655Kv1KjqY1MNHNMQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHNPGCq2iW7z
TLSH
T13DE28D53CF9054F6F7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34600E866257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 770KB
SHA256 439005c986b6748d03fb5e78f6815d163992a9d670060fdffd5454cf3860e83f
MD5 38e1136820aa354cc4b5952c77f719e8
SHA1 45b28c929cafb8d334fb23f9968c11c23f377ce5
SHA512 5b2216519b9df2dc63bb3172e53dff10e221901a154004aa52b37ce36089e2f734ddb6208cc7562c651f6870f30cf1e5e0408ec657ecba4a700a6592fd55d2a5
SSDEEP 12288:QMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I3:QnsJ39LyjbJkQFMhmC+6GD9
TLSH
T111F47E32F2D18437D1721A3D9C9BA3A4982ABE512E34794E3BF41E4C5F7D68138252E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-31_f78165a4723c678c3e45595d77e73588_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_smoke.exe
Size 1.2MB
SHA256 19dd2bc5a46c2977cb9565ce389ff973a2d33a891565033a6fe99f625506e929
MD5 de25d63dfddbc84496a61085763136c4
SHA1 232bd30d5db00baf72be414ad81aa2151a549743
SHA512 26283acffe471bd062badfc1b5e1fd834afb17833a9b3b1c9aa8741e60c8dffdfd49908dfed3d905fb1ccd42c264b0bdf80494bf3795d558527a6ca455b3082d
SSDEEP 24576:RLqPgtBqEuXlpnxGj5beSv7DHrozdCS6aTe:0IrWlpnxGNbreCSLT
TLSH
T176458E20B773C237E97720F1497E8A6EA168E6B40725D0C7E3C81D3D0DB59D26A36687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cde5018.bat

Path C:\Users\Admin\AppData\Local\Temp\3cde5018.bat
Size 187B
SHA256 25f77f82b04b22f6e4be656fb73cff493a18027b9979a95b28dca4da2a32f7aa
MD5 b64fd4080381faa0c57ba59d3fafb542
SHA1 f112bdd917c535f9e76bd7f3782f23323ceb8a26
SHA512 c9aaa3378261af46f4274aa84ac504e7b160924f137a869384ae541f19ed5ab54f871923148f84deba9433e4ffb33d640128a34e8c32107ab837d3cf1fd4ad54
TLSH
T1C1C0120182C7CA6F1E58502B16F9628ED0650C9C3B496B158B2088AC62EA41EB5C3306
MD5 SHA1 SHA512 TLSH

Submit Download

53cf1482.bat

Path C:\Users\Admin\AppData\Local\Temp\53cf1482.bat
Size 187B
SHA256 373464151e009aa4edcf464fe3766398bc94b12ddc907859e42a70f1a49cbfab
MD5 39e9a9c085cac877cf239f34abded5ae
SHA1 ad72a16ec894b2e1d0aaee500e7f0afe52661a80
SHA512 ca9beda6359a54153967eb3380b1fa2fe4c42d8a89bf54fbbaa90dc94ad9d43e79d53b18ab9b0a112db76e2fd9a003b04ab89c629c27139d51362ec669a73822
TLSH
T156C022028183CE1E0800801706E0604CC02008593B682B101B30802C309A81DB6D7380
MD5 SHA1 SHA512 TLSH

Submit Download

QOPtqH.exe

Path C:\Users\Admin\AppData\Local\Temp\QOPtqH.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-143-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/840-138-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/840-140-0x00000000005D0000-0x00000000006A3000-memory.dmp

Download

memory/1736-146-0x0000000001000000-0x0000000001009000-memory.dmp

Download

memory/1736-76-0x0000000001000000-0x0000000001009000-memory.dmp

Download

memory/2560-144-0x0000000000270000-0x0000000000279000-memory.dmp

Download

memory/2560-5-0x0000000000270000-0x0000000000279000-memory.dmp

Download

memory/3688-145-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/3688-67-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/4428-136-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/4428-0-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/4428-9-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4428-8-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/4736-135-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/4736-142-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads