cb8298339c491ef49c65d784ec19c736a8dc69bd55ab6d60c685c99a9514b52b

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
Size 8.5MB
Sample260930-nwmdmavckd
SHA256 cb8298339c491ef49c65d784ec19c736a8dc69bd55ab6d60c685c99a9514b52b
MD5 488b9d0444769bdf1c0b4bbd9d2891c4
SHA1 4e41b1a54768e9c82def4ebc6dd993f138345f51
SHA512 99cf056236a3022ebfd90836f257734e14c8f0d90f6f0ca26528139e3035be4ad0c22b282132c9392aefffc97903e2e20ffa36b6e529757e049b531830e41efe
SSDEEP 98304:CdYOXwnS4rVR5v77GBfWx77GBfW1p1zYuraV8mqoq2Vjnm3tY:nIcRGBfW1GBfW1pVVGnKO
TLSH
T19F967C0273E58076E0B26670857A97659332BD701F32D6EF66947A1E7E33BC08D36362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\G:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\K:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\M:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\O:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\V:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\N:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\T:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\U:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\Y:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\P:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\Q:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\E:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\H:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\L:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\S:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\W:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\F:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\I:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\J:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\R:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\X:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
\??\Z:\	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2524	2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_488b9d0444769bdf1c0b4bbd9d2891c4_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthy.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 10.6MB
SHA256 ea7a1d83fd112da06ff11642b7e4d91b6d85a682cf12ce9b79b214e618b04438
MD5 35069334dbb4f7a07c43e20bd80fd652
SHA1 59d4f57eda72bbcbcafa80386de2d9f35a5262be
SHA512 76b48a60b14a5f5be261e4af5d0034259172be03e83b8c38a3b318d7de634f6aa24a1a3a847acba1c5c90c81aa6edc533ef7c99067b2cb36e19e7c1591bc91ee
SSDEEP 98304:CdYOXwnS4rVR5v77GBfWx77GBfW1p1zYuraV8mqoq2Vjnm3tUoq2Vjnmu:nIcRGBfW1GBfW1pVVGnKOGnN
TLSH
T112B66A0273A880B5D1F2A67485769765E372BD201F31D7EF66947A1E7E33BC08936322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download