Overview
overview
10Static
static
10Malware.2024.11.18.7z
windows10-2004-x64
1Malware.2024.11.18.7z
windows11-ltsc_2024-x64
12024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
102024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
102024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
102024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
102024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
102024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
102024-11-18...et.exe
windows10-2004-x64
102024-11-18...et.exe
windows11-ltsc_2024-x64
10Analysis
- max time kernel
152s - max time network
203s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/09/2026, 20:25
Static task
static1
51 signatures
installerupxratwindowssecmainteamf9a925doztdarmzimamusedunkanformadogmafchanfabiofromoffice04runtimebrokerbackdooraspackv2trojanspywarequasarpadodorwormwabotstealerstealcinfostealerredlinemetasploitfloxifrenamerdownloadersnojanxwormblihanstealerkawaiiunicornneconydnjratcosmuxredberbewrahiwiransomwarenominatuscryptostormserkeyloggernanocoreasyncratamadeymofksysqqpass
Behavioral task
behavioral1
Sample
Malware.2024.11.18.7z
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Malware.2024.11.18.7z
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral6
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral7
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral10
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral11
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral12
Sample
2024-11-18/Backdoor.Win32.DarkKomet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral13
Sample
2024-11-18/Backdoor.Win32.Emotet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
2024-11-18/Backdoor.Win32.Emotet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
2024-11-18/Backdoor.Win32.Emotet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2024-11-18/Backdoor.Win32.DarkKomet.exe
- Size 2.4MB
- Sample260915-y7ajbazzfs
- SHA256 710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91
- MD5 bfe942ca711739d291ad987cc724a3a0
- SHA1 317df04b21c29b20c45c4a007ca33cf3d6357392
- SHA512 836bd519511e760a8496787f02dfe26aeb3b45c1603cbbaa2c7adcb5dccb7fc794a87033634f8870fe686e864b6fca42bc920ebc934e78f0f4c7b7d4c10d84e8
- SSDEEP 49152:snsHyjtk2MYC5GDvxdth7VaHBIW2Y4XxChF6Hq2BIetbWx:snsmtk2a8F6fT4XAhIH+eVWx
- TLSH T1DCB5F1E2B2D1803FC13107347C5AE2A55496BF421F25A9AFBBE92D4C5B3E6D118DC293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Executes dropped EXE 7 IoCs
pid Process 1464 ._cache_Backdoor.Win32.DarkKomet.exe 2892 Synaptics.exe 3520 Setup.exe 4304 Synaptics.exe 1048 IKernel.exe 3924 IKernel.exe 1908 iKernel.exe - Loads dropped DLL 16 IoCs
pid Process 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3520 Setup.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe 3924 IKernel.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" Backdoor.Win32.DarkKomet.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.ini IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe Setup.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll IKernel.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layo54f7.rra IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.inx IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\core8fa.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\corecomp.ini IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor90a.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\layout.bin IKernel.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data54f7.rra IKernel.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu5526.rra IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000 Setup.exe File opened for modification C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\obje948.rra IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\IScript\iscr9a6.rra IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.cab IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuse967.rra IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\data1.hdr IKernel.exe File created C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu5507.rra IKernel.exe File opened for modification C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.exe IKernel.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKernel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Backdoor.Win32.DarkKomet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Backdoor.Win32.DarkKomet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKernel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iKernel.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39040274-3D36-11D3-88EE-00C04F72F303} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4817E4B-04B6-11D3-8862-00C04F72F303}\NumMethods\ = "6" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{787D0980-F63F-462C-86BC-FC23847C70F4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15F051E6-59A9-11D3-A25D-06D730000000}\TypeLib\ = "{DED1EA29-3F89-11D3-BBB9-00105A1F0D68}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1B9357F-24B9-11D3-88B2-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEBEC920-1849-11D3-A8FE-00105A088FAC} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C8D0880-1AC4-11D3-A8FF-00105A088FAC}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupFeatureLog" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B16-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC5-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\ = "ISetupShell" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.ScriptDriverWrapper.1\CLSID IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27D2CF3C-D5B0-11D2-8094-00104B1F9838}\1.0\FLAGS\ = "0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupFeatureLogs" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\ = "ISetupObject" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\ = "ISetupTransferErrorInfo" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39040274-3D36-11D3-88EE-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83755DD1-086B-11D3-8868-00C04F72F303}\ = "ISetupObjectLifetime" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80FDE82A-2CAA-11D3-88C3-00C04F72F303}\ = "ISetupObjectReboot" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{348440B0-C79A-11D3-B28B-00C04F59FBE9}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\ = "ISetupStringTable" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\ = "ISetupSharedFiles" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.User IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}\1.0\0 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C8D0880-1AC4-11D3-A8FF-00105A088FAC}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4FF39B9-1A05-11D3-8896-00C04F72F303}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB9BF17-267D-11D3-88B6-00C04F72F303}\ = "ISetupTextSubstitution" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2583251F-0A04-11D3-886B-00C04F72F303}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6494206F-23EA-11D3-88B0-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Common Files\\InstallShield\\engine\\6\\Intel 32\\" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEBEC920-1849-11D3-A8FE-00105A088FAC}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\ = "ISetupCABFile" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\ = "ISetupObject" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\ = "ISetupTransfer" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" iKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{112EB4F0-5A48-11D3-A90A-00105A088FAC}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94F4A332-A2AE-11D3-8378-00C04F59FBE9}\ = "ISetupMainWindow2" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E561C6B-425D-4E3D-95CA-A2D289D7C3FB}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFED5DD0-0694-11D4-A934-00105A088FAC}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B964AF40-4AB7-11D3-A908-00105A088FAC}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DED1EA29-3F89-11D3-BBB9-00105A1F0D68} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15F051E6-59A9-11D3-A25D-06D730000000}\ = "ISetupScriptError" IKernel.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2080 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 1904 vssvc.exe Token: SeRestorePrivilege 1904 vssvc.exe Token: SeAuditPrivilege 1904 vssvc.exe Token: SeBackupPrivilege 4556 srtasks.exe Token: SeRestorePrivilege 4556 srtasks.exe Token: SeSecurityPrivilege 4556 srtasks.exe Token: SeTakeOwnershipPrivilege 4556 srtasks.exe Token: SeBackupPrivilege 4556 srtasks.exe Token: SeRestorePrivilege 4556 srtasks.exe Token: SeSecurityPrivilege 4556 srtasks.exe Token: SeTakeOwnershipPrivilege 4556 srtasks.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2080 EXCEL.EXE 2080 EXCEL.EXE 2080 EXCEL.EXE 2080 EXCEL.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3108 wrote to memory of 1464 3108 Backdoor.Win32.DarkKomet.exe 86 PID 3108 wrote to memory of 2892 3108 Backdoor.Win32.DarkKomet.exe 87 PID 1464 wrote to memory of 3520 1464 ._cache_Backdoor.Win32.DarkKomet.exe 89 PID 3520 wrote to memory of 1048 3520 Setup.exe 91 PID 3924 wrote to memory of 1908 3924 IKernel.exe 93 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18\Backdoor.Win32.DarkKomet.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18\Backdoor.Win32.DarkKomet.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\2024-11-18\._cache_Backdoor.Win32.DarkKomet.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18\._cache_Backdoor.Win32.DarkKomet.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\Setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1048
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304
-
C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exeC:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1908
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2080
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\corecomp.ini
- Size 27KB
- SHA256 5214789c08ee573e904990dcd29e9e03aaf5cf12e86fae368005fd8f4e371bd5
- MD5 62d5f9827d867eb3e4ab9e6b338348a1
- SHA1 828e72f9c845b1c0865badaef40d63fb36447293
- SHA512 b38bb74dc2e528c2a58a7d14a07bd1ecaaf55168b53afc8f4718f3bf5d6f8c8b922b98551a355ebb1009f23cff02fd8596413468993a43756c4de7dfed573732
- SSDEEP 384:2ERJ48bJNafWlc/n++TOa2SZ4+CIPo2S4m:2ER3JNaM+MJIPo27m
- TLSH T1F0D2211A552A1ED5EAB8328D3C907C8C74CCF1610AF2F6A7C4FE748649B745C2E6242F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
- Size 600KB
- SHA256 985eb55ecb750da812876b8569d5f1999a30a24bcc54f9bab4d3fc44dfedb931
- MD5 b3fd01873bd5fd163ab465779271c58f
- SHA1 e1ff9981a09ab025d69ac891bfc931a776294d4d
- SHA512 6674ab1d65da9892b7dd2fd37f300e087f58239262d44505b53379c676fd16da5443d2292aeaae01d3e6c40960b12f9cac651418c827d2a33c29a6cdf874be43
- SSDEEP 6144:cTqa+rypBCk+Fx7/BCttXXikQklSn8nbFpBJkCcjalJ/M6HnpJpaijgBwTFg56lX:fr/SlSBUJjnNRjpTWamB4
- TLSH T178D46C267EB5D437C2228071CF688BD4EAE5EEA54D7209473B88371C1E71D46C727A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
- Size 76KB
- SHA256 590be865ddf8c8d0431d8f92aa3948cc3c1685fd0649d607776b81cd1e267d0a
- MD5 003a6c011aac993bcde8c860988ce49b
- SHA1 6d39d650dfa5ded45c4e0cb17b986893061104a7
- SHA512 032aba4403eb45646aa1413fdc6c5d08baab4d0306d20b4209e70c84e47f6b72e68457bbc4331a5f1a5fa44aa776a89eb9fd29d0d956fa2fe11364c26ab09ee7
- SSDEEP 768:uj5UUtenZewInMM66FwMd21I1FNVBt3NogjISsK7phsfTkF0kN1usI5FrAg1OBoM:Q5PI9F6SCdNoe57phsgW7Ag8lj
- TLSH T1327306327783C173D24212B1ADAAE6D9AF65BE475EE502073E637B8F3C31B14C859642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
- Size 172KB
- SHA256 8efcbd8752d8bbfd7ee559502d1aa28134c9bf391bf7fc5ce6fdfd4473599afb
- MD5 377765fd4de3912c0f814ee9f182feda
- SHA1 a0ab6a28f4ba057d5eae5c223420eb599cd4d3b1
- SHA512 31befb11715f78043b7684287b4086ce003cb66f97c6eff8c2b438eae29045d8856172c6b898be9f08c139edc4647c2bce000da497aed208b7a5a69d4d90c710
- SSDEEP 3072:r+qN/OeBOZOptEHrOM/JUb1pZHYJvY6zsB7qAJy/Km1kUpbVxgr:5/bPtQxJUb1pdGQ6z73vzpbV6r
- TLSH T1B1047B3137A1C471C1A5017E6E158BEAEFABFD628EA409433F54374DBCB2A51CD3A246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
- Size 32KB
- SHA256 32c6ad91dc66bc12e1273b1e13eb7a15d6e8f63b93447909ca2163dd21b22998
- MD5 8f02b204853939f8aefe6b07b283be9a
- SHA1 c161b9374e67d5fa3066ea03fc861cc0023eb3cc
- SHA512 8df23b7d80a4dd32c484ca3bd1922e11938d7ecda9fc5fd5045eed882054efca7b7131ea109c4f20d8279845ffeb50ef46fb7419d190b8cf307eb00168746e59
- SSDEEP 192:Ec9t9ShCx1JQ5BoQZgTWPLnOBog5MOSiYp7e9MCMWnaaAyqX:EAxoVgTNk9sM9pE
- TLSH T1A2E25412EFA695B6F6C540703D772577252D2C3018E5D027EBC6DC4E287E2A3496EB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
- Size 220KB
- SHA256 4f77a9018b6b0d41151366e9acab3397416d114fc895703deb82b20f40116ad1
- MD5 b2f7e6dc7e4aae3147fbfc74a2ddb365
- SHA1 716301112706e93f85977d79f0e8f18f17fb32a7
- SHA512 e6ae396bd9b4f069b5fafe135c0f83718cc236d1cf9007db7305bd5442c86483c0f1e0fad9cd6d547e8715278e23e6fafa973c63ebbe998a31a2153dbbbe7f83
- SSDEEP 6144:v4cBIsIikn+3HUYzZ2HWrXzXdgASLB2X4X:v4cBI5X+kkkqjXdpX
- TLSH T1B8246D2139B8C539C39E0B31EF666FB4F6F9DE544EE1484B1F582E1C9D35A48C52212E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.ini
- Size 200B
- SHA256 e564cdc2a8560d1307340c94006227e4d59c443514d2ddd1c6086af57a6d46ad
- MD5 2faaf3e9574a06e5fd06128832059804
- SHA1 bd674c3d5d52bc77aad7151ec41faff98d9ffe3f
- SHA512 11896122d14862617b92e2917753d880298a126826013bf8c8d1b4bf90153ecf3c8dc09accbc355e49f9be162c5193fcd12e28dcab1a9e87aa59793c40cb5b3c
- TLSH T1C5D022ABA608A10D2409062A317E6310D3D52C181130D839C3C44E08DD46A006E48A36
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Synaptics\Synaptics.exe
- Size 756KB
- SHA256 ad28c8427c3561463ece46a95d2359eb34b9c5b4e4198c4c9964a5b5e892a6ef
- MD5 48dbcef21ada8467ee00c12d5509ed29
- SHA1 bb803d530b49a90a1a1ee295a918a73b2cdda9f4
- SHA512 c929519370de3a767f5b6f57de558fef47f19eff9c3cb69c8427089e2cb55aa00af97cc1c5a3598ca5a0a9d0c4f8c0a97f438f20aff70530dab9bbb41e442e13
- SSDEEP 12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9N0sT:mnsJ39LyjbJkQFMhmC+6GD91
- TLSH T1BCF47D32F2D18437D1721A3D9C5BA3A9582ABE512E38794E3BF81E4C5F3D68138252D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2024-11-18\._cache_Backdoor.Win32.DarkKomet.exe
- Size 1.6MB
- SHA256 c503d2caad26da47dc01712b5fbad62980f7150facf0511e21d452ac64d13b6e
- MD5 06c21d83808efc7c0348753acff24e1e
- SHA1 a5fcbd6893610e89ed924f4d27d740ad6f462a2a
- SHA512 a939d05a45282233b41c98ac992b74542df2a4146155e2bdc86f3a934be67b92d8fd336d7265e54ec477691a94697d303643597f1d4a636207f1b80d798abc96
- SSDEEP 24576:7JdbgsjmdEBihT4GQc5O3kXaHBIW2YKRXxJ6tnhXVpBensKSuc94BIT88WJaZCbo:Mxdth7VaHBIW2Y4XxChF6Hq2BIetbWv
- TLSH T1047502DA95AE450FD6B043713198E16760C68E430B879AFBEB4E3D64633EAF144CD263
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\IKernel.ex_
- Size 338KB
- SHA256 fbf95719b956b548b947436e29feb18bb884e01f75ae31b05c030ebd76605249
- MD5 93b63f516482715a784bbec3a0bf5f3a
- SHA1 2478feca446576c33e96e708256d4c6c33e3fa68
- SHA512 2c8f29dda748e21231ab8c30c7a57735104b786120bb392eb1c20a320f2dddde392d136fd0c70853bb9af851bbe47df2955d8f9d5973b64870ac90bd12d2dd70
- SSDEEP 6144:GnqCU025Do1BIFcsvbEfeqbnTdOJzEANlA9atuimsU7gaeaiNqltaBZv4fvxg:Aqw2qnQcs4bh+zxNeim79GqlQuK
- TLSH T1F1742313FFEECBF32596113AAB20B73BA5D37D44CA83C52F0368194A6625CD6852344B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\Setup.exe
- Size 164KB
- SHA256 fe95a9fc8b2cdb5add76fbd326b1a11801eaa43c7d908f20cbdf413fd4d8dfde
- MD5 fb6674a519505cc93e28cf600bbc23a3
- SHA1 d5dbd3dabc4872710d5bdabfb3829f976efe92c6
- SHA512 fd4e93d545a704bbc197bcbfd1731c24fffff7aa05db11ed4ad9bcac458253b8fb368d13e48df3d3d322044f4d4cc9e134c24cc7bee4079110f591623e988912
- SSDEEP 3072:SMssQNxJUJTp2E+qvFuIoF1PYUGQQEKGLY+q+XrNJd2/GP+oh:9QOpkpNJ
- TLSH T1B4F3FC116BFA8625FAF36F71FCB816910A7BBD56AE38C60E1300555D1C70A94DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\data1.cab
- Size 586KB
- SHA256 52e8bfd8231b9fc5fa91541a7b73e9a378bff912d73f260f9697395e13934fb3
- MD5 7a6a7bed57891197746b6f32344c75f5
- SHA1 83a0d2d72052f86cc6fce776490189317684764e
- SHA512 6396266d4f8e1b986d0f3d6814999caa38832116e84a752ee29a853d7753d162e1586970cc87f138820a2a3644899864f1cd1835be6d9a759842087f20b0a8b8
- SSDEEP 12288:m2xBihWGDfPn06MOOQjn1AhO33ST6EuCWfcWeWgYwu8uh5lbCuh5ppb6:JxBihd46MdQhmO30bWfcW2YfJblW
- TLSH T173D423993F60480BC79ACAB7974ECAD93AB248845744C7C72782F341A85C637FE7C45A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\layout.bin
- Size 417B
- SHA256 b2c060f31e0db36f18874ec85c55f1e0966c1dbaf2a132398d0f8bfa7a0a84a8
- MD5 879bd0a51200b47312d8c4b78f740858
- SHA1 acdaec259f2b4587dadf0d7d0f1b90442224c017
- SHA512 6df263d03f5796b522425514eacebf7110f6e73ae4cbd004c7757e6ce1e1e755ae79071366ed64f153b77556a4a239fab4222edfd7bf6e9061989a2e1247f1e1
- TLSH T194E09B3D3A6F4A10D0101D75147F46D94BD0B9753150A3551364F0957C0E51CFD85063
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\setup.ini
- Size 172B
- SHA256 2f6f2a479b5a083238d960bb24c5f9f9bd551777e9f66205defeeac6db51eb81
- MD5 f538540e2cfc9a49e1d1a19d7db8234f
- SHA1 4ccc89fe6709a2b58d675e70e1150af32a399d4d
- SHA512 d469cba1840803096590d7d44c998459623fc1176f10e14884ac62abc2daa18924c2b174c432bbfdda571c10affe84c6cd54668cce58d8f927e5a31225d88044
- TLSH T1B3C08CAFAB48A50D280A462A313E3360EBD22C186134E965C3C54A09D54BA08AF89A36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\Disk1\setup.inx
- Size 134KB
- SHA256 1f5689560acf38d2a08eb546bedb8854337fd5961a44e28cc937db57c70c28e5
- MD5 65c7eed62975bee4c118e332110daabf
- SHA1 89dbf17bdb0992026d6a9b98c39cdc7c30351d73
- SHA512 09cc634b42c9bdd21323d69d387fc5b67862fc2e2e83d7a37051d2aeb08b7b6fc17ae2cc15b5217e0af3f729e210731ed6733ce5fd1123057fcfd2ad32156640
- SSDEEP 1536:MzPAngv7FRqPl0OfaN+hH73peLAE+1KDYRatyKyHK73WZZxlC0NrxMgGh7G18mrK:t0LvAE+1KgZtC0Y
- TLSH T1F2D39A61B4456E0BE37D973BC9679533B360B0549F23EB2221AB77386CC552B2F422B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft1D8.tmp\pftw1.pkg
- Size 1.3MB
- SHA256 96a8733706b182b10c60c509c0cca9e1da329385b78a7fe5bbe1655168c966f7
- MD5 fc1dc50af3c04a4504005db443b047be
- SHA1 df5b171c45b10d3ca7c9a30285f6bb3b5b9f8ea5
- SHA512 f418e0d9fcd7935fd43f9928d86d16266ae896ddd72cc5e3a8235bc4ee365253b6fe4bfec31c217414b60a72a9ef1b4e790c4bbd78d29678a01304be23a090cd
- SSDEEP 24576:qEBihT4GQc5O3kXaHBIW2YKRXxJ6tnhXVpBensKSuc94BIT88WJaZCbWv:qth7VaHBIW2Y4XxChF6Hq2BIetbWv
- TLSH T18D65337A2F048807857B79721FCAE60731EAD8D16BD1FB1289978321462E23379FE547
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\plf7E.tmp
- Size 5KB
- SHA256 7ccb3a50ca08c66a220e4da614cbaba1d05157359edd174223c788b86d929edf
- MD5 9efcc61a0baa38a6d7c67a05a97c7b87
- SHA1 72b713a72ef7e972dfd5be5f79da8e9aacedb296
- SHA512 ac57100b76826af9f7650417dd765c23b522e31a1f3b44bfe9e70ed520bf6c6eb1978118a8147c99487b05a7a4c4afc964f457b79f921ff8236e4d60561b1238
- SSDEEP 96:Kq2orCnavjFYCgENA3jOpAWaMd1ZcMeJgocuEaegn:KopxYuU2NaM9eJ4aegn
- TLSH T166B1B76ED7C653331592568A674923D1DF18B86C236323C4795EC08C3286798A7FF9F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scAfQINH.xlsm
- Size 17KB
- SHA256 e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
- MD5 af4d37aad8b34471da588360a43e768a
- SHA1 83ed64667d4e68ea531b8bcf58aab3ed4a5ca998
- SHA512 74f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPl2G+Q16BrvPbw/7m:oUatwNSSvY2IdkLQIBLt
- TLSH T19A82CF17AA58B65AC436943A945F283C4B0D6388761ECA4D72053B8599CF1AF4B9F08F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsRes.dll
- Size 252KB
- SHA256 cbe8127704f36adcc6adbab60df55d1ff8fb7e600f1337fb9c4a59644ba7aa2b
- MD5 48ea604d4fa7d9af5b121c04db6a2fec
- SHA1 dc3c04977106bc1fbf1776a6b27899d7b81fb937
- SHA512 9206a1235ce6bd8ceda0ff80fc01842e9cbbeb16267b4a875a0f1e6ea202fd4cbd1a52f8a51bed35a2b38252eb2b2cd2426dc7d24b1ea715203cc0935d612707
- SSDEEP 3072:TXRZKyskkkkknffCp5CrRb9YfMX0E9QsJB9cWe7Ka2c2DRJMn2b:ThzskkkkknffCp5CrRKluaqL
- TLSH T17F446301E6EA814FF6BEAB34DCB11EB44FB23C55DA30863D7AA9711D1471A909C12F1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt.dll
- Size 324KB
- SHA256 148d8f53bba9a8d5558b192fb4919a5b0d9cb7fd9f8e481660f8667de4e89b66
- MD5 61c056d2df7ab769d6fd801869b828a9
- SHA1 4213d0395692fa4181483ffb04eef4bda22cceee
- SHA512 a2da2558c44e80973badc2e5f283cec254a12dfbcc66c352c8f394e03b1e50f98551303eab6f7995ac4afd5a503bd29b690d778b0526233efc781695ed9e9172
- SSDEEP 6144:KzbdBEFj2WevDaaf4SUANAV+sckpp/+oZO2qwZ1YN3jWo5KDjr73rgE0:oBEAH33AVnpRoO1pWK/PbgE
- TLSH T1A9647E137AF5C57AC68B4230FB285FA8B6FD97551DF0D8835BC40A2C5E37846C226A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\pft1d8.tmp\disk1\data1.hdr
- Size 14KB
- SHA256 d2f967c808f13b3d64d99f2109a735dd759a5814f8a1fa72aa1751035904499b
- MD5 b2caa6c179bd67968e7828e9005a07f7
- SHA1 6dc8d77254cb32b73047ca6310e2bb7c3953bdd7
- SHA512 07a7c517e379ab5821867fadaa5e2c75245745d2c8b029849de0b468a9f5a0f3777ea02e2999f3d8ccc7ae969d020efba3e800ba01e30fb584de153c77f44a0b
- SSDEEP 192:wXbavwr+X56uqZoeKfgtlflflflflflflfl+IwVrny6vb:wX+Irm/eKfTuYb
- TLSH T13E6281A17B21AF7EF848933A71571B892B62E14426A1EB4B910C9DF13C13706EC5A37D
- MD5 SHA1 SHA512 SSDEEP TLSH