Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 16:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CoDRconTool13.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
CoDRconTool13.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target CoDRconTool13.exe
- Size 19.3MB
- Sample260916-tlj4eabf49
- SHA256 a76c18586b1ad597535b10dd576c76539126a8c4dbed873720efe35f0eb5a702
- MD5 dfe9d2e468de70ca99cbbdfc22bfe30e
- SHA1 1d9fa15430759cfd6c041a6ce9095e6623b1849b
- SHA512 0dabef3f8f7183f1ea436f9187b7c105a0e18f17183910b861042af3e662292f41d35b86aa3d15ecd75fa0edacdbead744fc43dea264b60bfd5c1914a2e3859f
- SSDEEP 393216:Qt3EW8aNShhfpfoV6DDcBNXMEAWIEboK+/Nu12psO9GBxhWyBFyos:QHaRfoADIB+EAMb1+S0E1Fyos
- TLSH T1F917334E35CB9C94DF99AA3AA2B3173BCE3D4D275228DA335471B5600C7338576387A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 5384 regsvr32.exe 3380 regsvr32.exe 5128 regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 23 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\comdlg32.dll CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll CoDRconTool13.exe File created C:\Windows\SysWOW64\Codejock.Controls.v15.0.1.$$A CoDRconTool13.exe File created C:\Windows\SysWOW64\comctl32.$$A CoDRconTool13.exe File created C:\Windows\SysWOW64\Codejock.Calendar.v15.0.1.$$A CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\shdocvw.dll CoDRconTool13.exe File created C:\Windows\SysWOW64\Codejock.CommandBars.v15.0.1.$$A CoDRconTool13.exe File created C:\Windows\SysWOW64\RICHTX32.$$A CoDRconTool13.exe File created C:\Windows\SysWOW64\tabctl32.$$A CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\Codejock.Controls.v15.0.1.ocx CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\Codejock.Calendar.v15.0.1.ocx CoDRconTool13.exe File created C:\Windows\SysWOW64\comdlg32.$$A CoDRconTool13.exe File created C:\Windows\SysWOW64\MSCOMCTL.$$A CoDRconTool13.exe File created C:\Windows\SysWOW64\mswinsck.$$A CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\Codejock.CommandBars.v15.0.1.ocx CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\comctl32.ocx CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\MSINET.OCX CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\RICHTX32.OCX CoDRconTool13.exe File created C:\Windows\SysWOW64\MSINET.$$A CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\comdlg32.ocx CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx CoDRconTool13.exe File opened for modification C:\Windows\SysWOW64\tabctl32.ocx CoDRconTool13.exe - Drops file in Program Files directory 48 IoCs
description ioc Process File created C:\Program Files (x86)\CoD RconTool\Logs\Status\do not delete this folder.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\newalert.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Chat\CAList.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Lang\Nederlands.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Logs\MessagingCenter\example.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Preferences.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\HistoryPlayers.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\nudge.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\popup.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\ss.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Styles\Windows7.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\codrt-icon2.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Logs\KickCenter\Reason.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\codchat.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Logging.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Chat\pbeula.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Chat\pbucon.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Chat\PlayerWarns.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Chat\SIList.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\pbeula.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\airhorn.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\HistoryPlayers.$$A CoDRconTool13.exe File opened for modification C:\Program Files (x86)\CoD RconTool\Uninstal.exe CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\profiles\Standard.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Uninstal.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Logs\Communication\Communication.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Logs\Console\Commands.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Logs\IngameChat\do not delete this folder.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\CAList.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\IC.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\SIList.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\CoD RconTool.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\License Agreement.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\PlayerWarns.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\shipshorn.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Styles\Office2010.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Other.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\FormData\do not delete this folder.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Preferences.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\foghorn.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Sounds\shipsbell.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Chat\IC.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Global.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Profiles\Standard\Chat\pbucon.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Server Status.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Styles\Office2007.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\Tempfiles\Logging.$$A CoDRconTool13.exe File created C:\Program Files (x86)\CoD RconTool\ICList.$$A CoDRconTool13.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoDRconTool13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{262438B0-034B-4EFA-A7D8-94E409B7F8F1}\TypeLib\Version = "f.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D56366F3-283A-41A4-B8FE-945CF69612D2}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31F33177-B6D5-4214-ACC0-CD608CC4A159}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.PushButton.15.0.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D05A3DE8-B5DD-4382-964A-D2FE01F0D75C}\ = "CalendarThemeFormulaMulDivC" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56728A35-789A-40D9-B564-7577DA549319}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79968A35-789A-40D9-B564-7577DA549319} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBEB0398-39C1-424F-9D94-FCA6112260B9}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1712672C-EC4A-4D21-90B9-E63C79E049EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C45DBA-8B73-4F24-B3B5-56731D6963E4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A075600B-BC62-439C-8A12-D75ED5D4E13D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{280A7B16-7BE8-42EC-870C-8849F5540F14}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{16BF83DC-D087-43E3-A84A-6AB4BDBCBE7F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DA481A0-36E5-4AA5-85E3-EC31BBD6AD1C}\Control\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F42BAC0-8D50-404F-B602-7DCADF54B4A6}\TypeLib\Version = "f.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A77113E7-46A4-4F99-83D8-C6D3C2B390FC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{151FF694-1D1A-4AFA-8DFF-8798A2181226} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.PrintPreview.15.0.1\CLSID\ = "{E06267F5-7A98-4757-86BA-A5E2044F0EFB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64F77DBB-8818-4FFF-89BB-0E27A8C805BD}\ = "Xtreme Tab Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{550AF03D-69D9-4B45-A487-4F74FC46CC65}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFD2F130-532C-4BD6-B3BB-6C0063FD3A61}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77956A44-9686-476D-AFE6-FF5255F866A8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D87BCC77-27BF-4CB1-9ABF-1788D9835223} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CFB2F42-1E67-41A5-ABC4-2262D4B914CB}\TypeLib\ = "{555E8FCC-830E-45CC-AF00-A012D5AE7451}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37831927-D91C-4911-ADA7-3A1EB6EB003B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{16BF83DC-D087-43E3-A84A-6AB4BDBCBE7F}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{402D42B4-4E72-468C-96A8-C05F96ED713A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF218886-11D1-4260-B9C1-DFB031FB575C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FED5027-B4A5-492F-ADA0-56E1B0772A53} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{030986C7-A481-44C1-A5CD-55ABC3C852D1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{567B9842-AE6D-46A8-BC77-CEE7D5CE9ED7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324B467B-1E0F-446D-B92B-BEDBEF77302F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F985B8F-403B-41C9-9729-7C965ECCA543}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF87BE9B-8784-4B18-976D-F889C1F8B1E9}\TypeLib\Version = "f.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04BF4A4B-ED5B-43E3-B4A1-99B7B34B778E}\TypeLib\ = "{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35BA786A-9122-41BC-9530-AA39F9A4565A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.DateTimePicker.15.0.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7466056D-A609-48C5-BF08-C4FCE7F42DD2}\TypeLib\ = "{79EB16A5-917F-4145-AB5F-D3AEA60612D8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51837751-7F27-46D2-91A1-0442FD6DA0DD}\TypeLib\Version = "f.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCF5EAE-9731-436F-8D92-C949D200ADA1}\TypeLib\Version = "f.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.UpDown.15.0.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{981E24C0-DF46-446A-974B-9351D7BA750A}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4569783D-A5D8-4569-8690-592295C5583A}\TypeLib\Version = "f.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6AD86C5-48A7-4625-9640-8EA7D9C2A8B5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1935891D-B4E9-45C7-AAF6-EF340E785590}\ = "ITabManagerMargin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{235113E7-46A4-4F99-83D8-C6D3C2B390FC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B1C53B4-2327-49F0-947A-2B36FAEC730A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A53CCB61-7E3D-4622-8185-468918610D57}\TypeLib\Version = "f.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE7BCC77-27BF-4CB1-9ABF-1788D9835223}\ = "ICommandBarActions" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E805BE3-FAF9-4CE9-978C-17E58F2C046D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8FFC2-771D-4652-8C75-7BE414CEA1E3}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FB788B9F-E371-4690-ACF6-538F88C33741} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC28A35-789A-40D9-B564-7577DA549319}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{394723D1-9A8A-4D0C-8B12-14861055B0E0}\InprocServer32\ = "C:\\Windows\\SysWow64\\CODEJO~2.OCX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.CommandBars.15.0.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B169540-E640-4DC4-AB7A-F9A8653DCCA1}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F615F2AA-E12D-437F-8A9B-529DC963768C}\Version\ = "15.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6AD86C5-48A7-4625-9640-8EA7D9C2A8B5}\ = "CalendarThemeOffice2007WeekViewEvent" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{488D8E12-009E-46BE-B9CC-8713882F333A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4568A35-789A-40D9-B564-7577DA549319} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28A1CBE6-4B44-4BEE-A7A8-8F5954390D95}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Codejock.Label.15.0.1\ = "Xtreme Label Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{452D1A71-D746-4642-A385-16F249BB6A62}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63250270-11DA-4A0C-BB5F-DA2832FC2272}\TypeLib regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4860 wrote to memory of 5384 4860 CoDRconTool13.exe 89 PID 4860 wrote to memory of 3380 4860 CoDRconTool13.exe 90 PID 4860 wrote to memory of 5128 4860 CoDRconTool13.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\CoDRconTool13.exe"C:\Users\Admin\AppData\Local\Temp\CoDRconTool13.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Windows\system32\Codejock.CommandBars.v15.0.1.ocx"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5384
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Windows\system32\Codejock.Controls.v15.0.1.ocx"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3380
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Windows\system32\Codejock.Calendar.v15.0.1.ocx"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5128
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\CoD RconTool\CoD RconTool.exe
- Size 26.0MB
- SHA256 24a21e7cda9fa41d194b3dc1e446d8653d726d0e4676e380010f68e56118ebc4
- MD5 2cb56168ee53de3362d6ada6ba77aae4
- SHA1 dfe4cc1272ff987a646c418a7d18f97ecb5a7b46
- SHA512 2335e4d49f3d9403c00b0aedb20e5ca69c6e1777908893761fd7fb220a59026d4cbcffd7d723c195bcbaede7b6549402b190a801c72903a4a6d1fcc2565398b1
- SSDEEP 786432:lfV6nMyZSRnMy5Q/4v5i6C5oUncVxlJpgzFOaRx1Z3Z/ci:lfV6nTZynT5QQv585oUncVxlJpgzFOaD
- TLSH T10A578D07E701A40AF0418674B592931F6617EDB30229578FB7CD3E24B671AEB6DE630B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Codejock.Calendar.v15.0.1.ocx
- Size 3.6MB
- SHA256 ae8de6639af9571336d6a8f362549b282e40ac166414d91e8164dae3f6fe3e4a
- MD5 7bf09b6e2075d111efbf97eab39c0ce8
- SHA1 606469272ee7a4bf72180c218c34965df1b54318
- SHA512 24231e7c123ee16c4d2b0d468090a920024a263f3e8d6b63880490d04f1dda6d2a49de32a507a67da98ba5b0ba7d66843155ee1f389e3ced3620f67bd4b73395
- SSDEEP 49152:CSMG1Km5UxOBV+qydTNto06hUwhD/hupkh3/rOWnhvce/a82L5HwsAcBbrH:HFHxyJ9cnDZce3zn8X
- TLSH T19006AF02B6EB40F8EB4D217415EEB739CB37AEC94B115FD7B248FA9D15321C1A532229
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Codejock.CommandBars.v15.0.1.ocx
- Size 3.6MB
- SHA256 f6d7c78496bfb846bec599977be5fd33f42fba380d7afacad72e5d760da076ce
- MD5 e1e66fdbf16c36875c3a617d7269189b
- SHA1 14fc5d34ea3c9c9ead9cac6bda4d636ef56c36e5
- SHA512 9e1e7bba70f472f68cb3f54203ec425552c7a218c159307f809d0ee2726a9b09a02e5bcf2df144a9d7ccc7a652aed63debe3a8cb2acc5b921d5d782aaf6e00f9
- SSDEEP 49152:dQyYkKTAIHhUwhD/hupkh3/rOWnhvce/a8cknma/5:a5kDAnDZce3znXN
- TLSH T1F706C042F2E340F9E60D253414EF7739C775AE9A4B019BEBD248F9AD19331C1693622E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Codejock.Controls.v15.0.1.ocx
- Size 1.8MB
- SHA256 7dd57f8763664a593c8bf2a0a86d9d70e8efe427e1474223642b5d541b51642e
- MD5 6a021b290d913525f2f7225462172690
- SHA1 501aeabe86439825fb99e9560bc2d00ac7442dcf
- SHA512 260d4f63b7a1a45aa49868ce12b2bd8464dc285e99413eafe559cd51995b421c5af22399b7a1987e172bcbc9f32d29fa3e3df3843bc587f8f2a3b1e5809c7a98
- SSDEEP 24576:GVmCTKuUBL4+NkZf/Rff86TUR7RWLWscG2moo9os:uz+L8fDTUsVifs
- TLSH T1EA956D02F59684F6F70D273018BFBF7997759EC94B148BD77268FA9D29322C1643220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MSCOMCTL.OCX
- Size 1.0MB
- SHA256 18a83d7a420a17fcb6f56eb3ba5362c975d32e5ded7553c6fd407f07bdb7b006
- MD5 f7bbb7d79adb9e3adc13f3b3c33d3d4d
- SHA1 cacb4b31d22419e6a9ddbffcf61ae42da0d5fb8a
- SHA512 4870ddbdf283d7f7f64d3f4bf556600a78804f6a94fc2ca7eb778e85d70b6d2d017aa35cbddf773b6a1b6d9a2813cd67fe54ede7859050a254a3e3c05616ae0e
- SSDEEP 24576:mnt4M/pL1wAEIqSBanK6CC33VTj+1R8xRFLqqmbD1kWIAqPA:mPL15EIqS1e6q3FmKbt4
- TLSH T189355C0273E58022D1FB16701A7B27A29BB67E656C38DA4F17503A0E6D32F81DE75327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MSINET.OCX
- Size 129KB
- SHA256 e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2
- MD5 90a39346e9b67f132ef133725c487ff6
- SHA1 9cd22933f628465c863bed7895d99395acaa5d2a
- SHA512 0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf
- SSDEEP 3072:R5JTZQu4epojdkYv55RCezn/T81B+ySRdL:RLTbP85RCezbwm
- TLSH T16ED33903B3D6406FF7A616302AF65BA55EF7BD153E2A984F9304329D1932784AB3431B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\RICHTX32.OCX
- Size 207KB
- SHA256 318cc48cbcfaba9592956e4298886823cc5f37626c770d6dadbcd224849680c5
- MD5 045a16822822426c305ea7280270a3d6
- SHA1 43075b6696bb2d2f298f263971d4d3e48aa4f561
- SHA512 5a042ff0a05421fb01e0a95a8b62f3ce81f90330daed78f09c7d5d2abcb822a2fe99d00494c3ddd96226287fae51367e264b48b2831a8c080916ce18c0a675fa
- SSDEEP 6144:hTr80hTueZXFOTSqP0xqRBTdtmFdCJErRj6/uE:NhzZVOTSqcxqRBKFdF6/uE
- TLSH T161244B1273E541B2E0B32B302A76A7719AB6BC612C39D68F1744766D6E32F40CD39367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\comctl32.ocx
- Size 594KB
- SHA256 bf4147f8a12bec3d54e3ef941475e29d852a1876117c6ce88f47b882ef6d4a03
- MD5 eb5f811c1f78005b3c147599a0cccf51
- SHA1 19e8153569d1379634ba9d12e84dc35b10faf689
- SHA512 2eeed9e02c2fbff39c021340a8fa10417a47e243ae2d6d5a54e3e69114dccb402f2d836500c6d771ff971cf0070def3004f3e828a9e7686ef0e1457e1583ecec
- SSDEEP 12288:0kec4KwGf99MSOeMkeXrnhIcVthDGn2mwCyP9tDCcrcJIVul+:0k6nTSXJI4l+
- TLSH T114D43A02F7D69122E8B61D30897B5BB22B727C557D35D21F2384777E1C72B81AE22326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\comdlg32.ocx
- Size 137KB
- SHA256 64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
- MD5 b73809a916e6d7c1ae56f182a2e8f7e2
- SHA1 34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
- SHA512 26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
- SSDEEP 3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
- TLSH T1DBD31A9273F66222E4B73B31297A27A06EBABC115D39D54F6710724D0832AD0DE74F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mswinsck.ocx
- Size 106KB
- SHA256 78dcd52e2311d08fc405ac2b54686ee66dda4fa68994819ae3315172b27e1f7f
- MD5 851f34233b9ec424695815cad2a909d8
- SHA1 05235076e55b1bfdf4f834d398c1044af5a734dd
- SHA512 ee24454128b64883c324b00133af1f2814a023195907f0cb8b3a51300233fa27ebb02d68a7f41067f209837e6f7fa0ee1dcc7f7bf40a48fee9318cb335e38727
- SSDEEP 3072:K6GPlGqWj9IBdmnyt9YEqFHb5RwK/3Yq63+sYHvs:K/49IrHc5Rw+g5
- TLSH T165B34B02B3D54272E6F267300E375B65ABBABD20AD31954F8350790E1D32B85EE3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tabctl32.ocx
- Size 204KB
- SHA256 2ec51f7a6c55c9eb8a98a96e9a830232eaeb33fff31ec6f02206669ad861a2bc
- MD5 3a76822b33b54575ffb448dbc71c0a8e
- SHA1 96012c6a2f3e9f2cb4b607f3ef7ceadf830c3d95
- SHA512 e6753d84101ed48f8ceee3c5d564cad833ed0022335334ea8c749a21bacd5e8ccc1539ebc74cc3af61a5abd3a387496fe66c76aa5fb2df72c22cb618195df1ed
- SSDEEP 3072:EG9xUPPK/LXInqJvP5DOr2dZ+/FIkRhXcAenqyTegd5/XZDDbtUeREm/UmL/80tx:EVGLYnqd5Kr2TaekRhXXentPVxDhR4qN
- TLSH T1C4247D0333E19172F0B32B7019BA6BA1BAB9BD211E39894F67502A5D1D71E45DE34327
- MD5 SHA1 SHA512 SSDEEP TLSH