Overview

overview

10

Static

static

5

2026-09-26...op.exe

windows10-2004-x64

10

2026-09-26...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/09/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-26_566ceb8d58ff15d6318b9f79620e6909_elex_floxif_manuscrypt_redline-stealer_rhadamanthys_stop.exe
  • Size 12.0MB
  • Sample260926-2f9e4sshjd
  • SHA256 c34d030ff6a69567ffca21813077235f633dd33be9f16c7ea26e18cbf4285163
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordiscoveryfloxifpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • UPX dump on OEP (original entry point) 3 IoCs
  • Drops file in Drivers directory 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 17 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-26_566ceb8d58ff15d6318b9f79620e6909_elex_floxif_manuscrypt_redline-stealer_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-26_566ceb8d58ff15d6318b9f79620e6909_elex_floxif_manuscrypt_redline-stealer_rhadamanthys_stop.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
      "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3316
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5892
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1292
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          PID:5868
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2508
      • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
        "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2480
      • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
        "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
          4⤵
          • Loads dropped DLL
          PID:1476
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1208
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1028
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1216
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5592
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5532
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1752 -prefsLen 27097 -prefMapHandle 1756 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {cc39e899-0eb0-429b-a0c2-279115504826} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
              6⤵
                PID:3740
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {1b193047-6567-4391-9dae-53af12f85b0f} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                6⤵
                  PID:3240
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25213 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {e8e1589a-a220-45ca-bb0d-250a4cc21939} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                  6⤵
                  • Checks processor information in registry
                  PID:5920
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27323 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {e3979a35-e035-49c3-b314-1474b25b2697} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                  6⤵
                    PID:4556
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34822 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3140 -initialChannelId {df6dabe0-f6f5-4b8b-882e-1fb16f637c71} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                    6⤵
                    • Checks processor information in registry
                    PID:4500
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 35010 -prefMapHandle 2800 -prefMapSize 270279 -jsInitHandle 2804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {e7f78873-bdc7-4c73-8b4f-7ca6ca1bd7c8} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
                    6⤵
                    • Checks processor information in registry
                    PID:4232
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5284 -prefsLen 35010 -prefMapHandle 5288 -prefMapSize 270279 -ipcHandle 4568 -initialChannelId {f8a29e29-f0ba-40f2-8f79-2183d552078c} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
                    6⤵
                    • Checks processor information in registry
                    PID:1696
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4792 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {839b92b7-a5fa-4401-a819-2ac864730d71} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                    6⤵
                    • Checks processor information in registry
                    PID:3284
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4784 -initialChannelId {73f9135c-e886-4b15-b580-cba4c06ad188} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                    6⤵
                    • Checks processor information in registry
                    PID:2616
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {d67cf2fc-0d1d-4b3e-b324-2470ad17d3f7} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5712
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2612
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  5⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:1212
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    6⤵
                    • Checks processor information in registry
                    • Suspicious use of WriteProcessMemory
                    PID:2732
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      7⤵
                        PID:2620
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5352
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2516
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5208
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1484
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5780
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1736
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4564
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3192
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3308
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2912
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4736
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:880
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    5⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:5164
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      PID:1224
                • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                  "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4880
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fa39a210-83eb-e444-b0e4-1acf58ca163a}\idmwfp.inf" "9" "4fc2928b3" "0000000000000188" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\Internet Download Manager"
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:4924
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "000000000000016C" "WinSta0\Default"
            1⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:5240
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:4832
            • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
              "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:5036
              • C:\Windows\system32\regsvr32.exe
                C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                2⤵
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:5708
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2896
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  3⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1504
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    4⤵
                    • Checks processor information in registry
                    PID:4632
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      5⤵
                        PID:2456
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:708
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2548
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4584
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:124
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3404
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5880
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:828
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4852
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5168
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3376
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:764
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5708
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3444
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      4⤵
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5496
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000188" "WinSta0\Default"
                1⤵
                • Drops file in Drivers directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:4836

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Browser Extensions

                    1
                    T1176

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Modify Registry

                    3
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    4
                    T1012

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    IDMGetAll.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                    • Size 73KB
                    • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMGetAll64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                    • Size 93KB
                    • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                    • Size 463KB
                    • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                    • Size 656KB
                    • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMNetMon64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                    • Size 564KB
                    • SHA256 9840d78e94f9df6b03be2246b9814263a5ddf287489cd260a25a4d51e4a1bc5b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMShellExt64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                    • Size 36KB
                    • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMan.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                    • Size 5.9MB
                    • SHA256 03cc62e9adb77a380f9dc12f67ccaaee5106f12844aa73ce32c914ddd16d607c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MediumILStart.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    • Size 51KB
                    • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                    • Size 197KB
                    • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                    • Size 155KB
                    • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmBroker.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                    • Size 153KB
                    • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmfsa.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                    • Size 90KB
                    • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmftype.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmftype.dll
                    • Size 42KB
                    • SHA256 3a47dbb1f86f2c51f3f8fb9c3a8b1309f5e182ab9af55179959104d262ce985d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmindex.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmindex.dll
                    • Size 427KB
                    • SHA256 1fdb0d5b31e080084c82e0b773dafc7860fa860938b8baef6a4d7f5bde659f73
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    symsrv.dll
                    • Path C:\Program Files\Common Files\System\symsrv.dll
                    • Size 67KB
                    • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ExplorerStartupLog_RunOnce.etl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                    • Size 8KB
                    • SHA256 f6864af9e7d45715dab65a35bfe0e06ab6db6d8e5aba108099aad2b89aa69bda
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                    • Size 16KB
                    • SHA256 36dc67aa212bb00fcfe46d804ef7c6c44d2b2f8c681ceba731941d0905463d96
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    webext.sc.lz4
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\startupCache\webext.sc.lz4
                    • Size 104KB
                    • SHA256 b09547252644ae47acc63fea0253db8d667295d6ee99e68f887c0386b1a3c920
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDM1.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                    • Size 163KB
                    • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 4KB
                    • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    s_1.dt
                    • Path C:\Users\Admin\AppData\Roaming\IDM\Scheduler\s_1.dt
                    • Size 316B
                    • SHA256 6d059e9c4670699aaa1b1594917d1be5fe752517d7c7e505f227e8dd181dcebb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    defextmap.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                    • Size 3KB
                    • SHA256 9d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    urlexclist.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                    • Size 3KB
                    • SHA256 9efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 db6dce1eba65b9f59662ff48f666bd6d58b6e5964f5fb385b9c4d850d676da21
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 81e93a402cd2f2ff2b3211722adea3535f0fe6f465ad5efaf2b9f719ec27da54
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 be8b240dc6d6bfb07f71b2f1d7a99740c1acc91a2f3f9e530bbbe0d4b708be83
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    75e86169-088c-497b-b007-8cf80ba9cc70
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\75e86169-088c-497b-b007-8cf80ba9cc70
                    • Size 235B
                    • SHA256 8904a9607b267ac4ddb5d87151352fd68d76ce851d52bbf885d9c2df38333b3a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    9bb88e68-a331-49cc-8165-f83d2bb38b82
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\9bb88e68-a331-49cc-8165-f83d2bb38b82
                    • Size 2KB
                    • SHA256 62705edabf8ba16533d6902b7771cf2cfa237147a67ecc890be8b2ff33dcc64c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    b77c37ea-e23e-4bf0-b907-15dc616dc7d4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\b77c37ea-e23e-4bf0-b907-15dc616dc7d4
                    • Size 15KB
                    • SHA256 07b03cdd219db9f79db8dfaef08f96bd25e1387ba28b23a5b696c8cea19463aa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    c3fbe76d-95c3-4c0a-87f2-171b1e6d22c9
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\c3fbe76d-95c3-4c0a-87f2-171b1e6d22c9
                    • Size 235B
                    • SHA256 a754c5636bde46cc3afe68f1524c801805ba1f05acf6922912e8dfff763119b7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    d2ded6f8-1320-49eb-948c-864ff5f130d2
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\d2ded6f8-1320-49eb-948c-864ff5f130d2
                    • Size 883B
                    • SHA256 aa691eea4798b6a852572347191fc3cbfd8022f1761b5d386c30ff5d46e0a244
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    d74e3177-72d1-4c1b-81fe-f4d804d57c51
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\d74e3177-72d1-4c1b-81fe-f4d804d57c51
                    • Size 886B
                    • SHA256 802f014f014ec3d3c64db3072adfb71312c014af2ecafadb1db2e64d5bab4669
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\extensions.json
                    • Size 16KB
                    • SHA256 b9c427dae81df9038fde650f67174363a0be32ecdb3b04dc1e8f90cb9588a81e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 62521eabe302b3d6a0b60c760cc8c636716c76adb07a4025db47cae43fecfee3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
                    • Size 6KB
                    • SHA256 ad5cdbec8c49ea0a26caf212c55104c338c41b0cc192d3e2127d6058cb98e326
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
                    • Size 8KB
                    • SHA256 517bce52c4ca57670081804a183afad4527be7ce471b8ff6a0111b3b4550404c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
                    • Size 6KB
                    • SHA256 b96810caeeef73f278f5bc0ead23be15bd2ba88645f55f85f4c2f74004c2c235
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 c01ca8fe95eacc6ac4d0d1fa60c30574425bcc2f9a40fb00e2e9e765444ade8c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmwfp.inf_amd64_be5722ccff6c2371.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371.ini
                    • Size 415B
                    • SHA256 1ba31e7c907190d2a6784d5bbe5741dec7f4562ac7081be4330aeeec32a8880e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/2612-890-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/2896-932-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/3176-9-0x0000000000B00000-0x0000000000B1B000-memory.dmp
                    Download

                    memory/3176-11-0x0000000010000000-0x0000000010030000-memory.dmp
                    Download

                    memory/3176-3-0x0000000010000000-0x0000000010030000-memory.dmp
                    Download

                    memory/3316-460-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/3316-8-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download