f39720be05f285c7c4addc52938e06f32f44316827278c2689adf634eaae8338

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Size 3.9MB
Sample261002-vx4sma1ejd
SHA256 f39720be05f285c7c4addc52938e06f32f44316827278c2689adf634eaae8338
MD5 2ef6bb298e70642b098a97c734763e47
SHA1 dfd35b388db534dfa4ea5c91dab5bfca95d20db3
SHA512 aca51e624759f86536493349e45eeec9f78aa8cf85d35fdbb7315a59863f0d33da6c58562c2375491eb2f8988b4aae1f73a20e4c3b2ff58d8c8c9ecd27a62d3e
SSDEEP 98304:d57KJIw7A24gD2lIIvn5P7NoyRZIelWYTCbOMUB2:rdwIkqP5P7NosyejHK
TLSH
T1EF16E022BA86C132D6A641B05D7DAF3E547DBA310B3581CBB3C41D2EDD706D25A3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
File opened for modification	\??\PhysicalDrive0	wzzx2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4200	wzzx2.exe

Loads dropped DLL 4 IoCs

pid	Process
3204	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
3204	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
4200	wzzx2.exe
4200	wzzx2.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\PhysicalDrive0	wzzx2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wzzx2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wzzx2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wzzx2.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	wzzx2.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	wzzx2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	wzzx2.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	wzzx2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	wzzx2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\wzzx2.exe = "11001"	wzzx2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\wzzx2.exe = "1"	wzzx2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	wzzx2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\wzzx2.exe = "1"	wzzx2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	wzzx2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe = "11001"	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	wzzx2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 6b00000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	wzzx2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb6b00000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	wzzx2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4200	wzzx2.exe
4200	wzzx2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4200	3204	2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe	89

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wzzx2.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_2ef6bb298e70642b098a97c734763e47_amadey_coinminer_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_stop.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Roaming\LiteGameBox_wzzx2\wzzx2.exe
  "C:\Users\Admin\AppData\Roaming\LiteGameBox_wzzx2\wzzx2.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

60E31627FDA0A46932B0E5948949F2A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
Size 1KB
SHA256 64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d
MD5 f8d3904655f1dfd5082a1e9c68b3e526
SHA1 d1df59f63a480c5615dc9e98659398b8406fb049
SHA512 60bcfab16e91c4ac09fa3dbc710da31cb039678e979a70d0a11c1634c9c7f00f23e910e10990aa1ebec9846730dc4a85bb0a693caf1cfbe5d54962794c16330e
TLSH
T1243157690851377354A13775C99B8DD79EF293911BA2D84AC2644A460822FCA1FC80F7
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 26KB
SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
MD5 ff690102c64e4baa8bad0c6a7a0fcac2
SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
TLSH
T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
Size 834B
SHA256 f64b94c786a213df5f80716f98b2e4f90edb77609b43dce1c788792f460a53dd
MD5 6e7576248913afc6faab4229d85e3fcf
SHA1 143ad96b5dbb9c61c0fd5c61c91ca2f60c171624
SHA512 3481f48d977635f480beace91a79752fbc22377239d722cfc6921c63d9cc2ae3bf899c810d37d2939370867c8e323997ddd63a13aa823a6036e5ea332bed0c5c
TLSH
T1E4011E9644083012A4806B24C948ED5FCEB8A39D4FEC9802A0E48D8F5E53FF86B5216A
MD5 SHA1 SHA512 TLSH

Submit Download

60E31627FDA0A46932B0E5948949F2A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
Size 182B
SHA256 d1458bc4d15646bc80b2021ab39756fc3230aa4b6ebca183ac5be5b33c31e335
MD5 56ea8666bb2477e160c1087ed1c2df05
SHA1 11c5d998ee1aa6324d5942d0b8a1ba1ab579c6e9
SHA512 cb992465dcc81921e21f9be3f2b9afeb65db22228dfc0b98713924dfe0bc026d55c4c257bf7378c498e3f18a89e39c165a20d584a6d07d450a3c6b20a5ba3b19
TLSH
T114C08C046718C202F1900F7A0CA209209A303905861383288B3C2228483CA9008B7809
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 212B
SHA256 bfd3d6edf7caaec82aac96d14915bc7bab602ac362f56fdc58b6a607a4c27dd4
MD5 0006efd428747d08bb1345cd472feeb8
SHA1 7f91f489167d323925769819da52d48f1d8b7526
SHA512 d2d10a95d347272c3e548d2d512065ea4ec3dc599a17eab2474c748842dc5243665314bea7182b485c102f49902c039cb740524e69be05dd321a5004a5222194
TLSH
T136D08C0017290243F0660B3E1ED21B076F66EFB28541CB091774270A4A3CE21ECB8C67
MD5 SHA1 SHA512 TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_FF4B5EF27F9B55A4B2ABD52FA5FB9610

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_FF4B5EF27F9B55A4B2ABD52FA5FB9610
Size 408B
SHA256 358d5d1f636b5e25436fbaecf1f0ca9accb20551578a52f7000fe9b9fddb0e58
MD5 830165e9c13cc00225c59ac818f97387
SHA1 af21f8e4e56e70ef6ed557b7b4f4f0c848864171
SHA512 8d43e19becfec952d7eee3a39a16a84f2a06c39e7759789adc2df0a4824ef24e14c2833ceb615b04f5aa1b3424f4ca996a0317af6f9585c928b9c0659c356c23
TLSH
T131E07D181779833CF175CE784ADDA364C41FFB22186002A2415252467A15A00EDB363D
MD5 SHA1 SHA512 TLSH

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 404B
SHA256 2f895f93f2b8c1cf65319881fdde9ffab2d08a3210ef19e2ba1938c0ce19830e
MD5 d386d0c5ef0b0696db886fa8a734d592
SHA1 5564fdf440a9e22afbc4b781516b3999be286f24
SHA512 b52c00f0196b6e808d1b055a657b25a721c8cdb8fd0a9b8e0ad2d9bfd9b2b1c8a92c96eb28725f3ea7de9460746603c2be1c4e5fbc235f72ddf4e9369c8808c9
TLSH
T101E07D0859FE62ADF1B4CE759BD555166A17F901046003FA81C12202AA23F100CE1931
MD5 SHA1 SHA512 TLSH

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
Size 188B
SHA256 f4a11480917d38586facf69559476441c9768b494e62df45a6003641d6cfc141
MD5 b4fbcd91105251e5d4e118735bc8b285
SHA1 3fd4f3cec9abf5f2d95440ae6efbaba26d45d159
SHA512 5c1bf1f56b059907a2ebd7d38f9bf9871362eccfd47a42b544a9126162c68b411e70ad17dc571ac624e58ca2f969c1fcea019dec91848bc1d3c180dad6adabfc
TLSH
T152C02B0833E58A06F5A50F7E0C2952005F347D05C311C3194B3C2318993DE104C73D01
MD5 SHA1 SHA512 TLSH

Submit Download

D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
Size 408B
SHA256 259fe7018c424719ab8ae182afd000e0b9fc998fad80bc0586c3e696051d9af6
MD5 94fd0e2b2cbdfe2c5e2ca70ca967d635
SHA1 748cd950cac2e71873320d4f145069d2fee8f710
SHA512 6d868a84a015a696794b57cb42dd72a7e87e52f2739d16e59acb1ff5b02f412907250c72c7bc112a3d4bafb75d713e00c10d8975e452288dd1002cb5842a02d3
TLSH
T1D4E07D0822FB826EF4A0D57889DDB13A192BF702050E51FA00501349B752B011D62E31
MD5 SHA1 SHA512 TLSH

Submit Download

360NetUL.dll

Path C:\Users\Admin\AppData\Local\Temp\LiteGameBox_wzzx2\360NetUL.dll
Size 231KB
SHA256 a7ff68fe983f3fc97efcd0970e3f93952658420290a3e3d1cec97a2e0bfa83ed
MD5 6c2cd3003689a373b158a4f8c6fe75a7
SHA1 f4938a64224b9cfc16920a83b4cb9ef83c8b68ff
SHA512 8a89da3786bcc7b2936e090a35b51fe59fa37c5b80bac5fd471777b9068a79b8f46bdeaf22f8d5be8bf47a3e1e239366f04ea1fb49c2233526bd1ea545960bd0
SSDEEP 6144:WJlU7zM4nGH4Ye1XBINNN8YCh2Jo9TB7PT0Rc1:W/SMH4YUXBIfPdo9T1l
TLSH
T12934AF527B81C073C58F163580E6C72A5679A275036CC6D7B7542FBA9F203D2AA363CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360base.dll

Path C:\Users\Admin\AppData\Local\Temp\LiteGameBox_wzzx2\360base.dll
Size 862KB
SHA256 a9251bd5e8591d165420c41570c414b6283c6b6abf802986aac4f1d19972a4d7
MD5 e43e7e408bfca335cc4240b7c1bbb8ca
SHA1 52965129de897ca96834d98aadd55307fd7f5712
SHA512 31c03fa1746aafe00854bacfb4a59cc382da3fc4f652fd422b7a217747341fedc34a1f3bdef59efdcb79edd70df7652e19608ea03f622abcfac4a9044eaa86ef
SSDEEP 12288:QVvJQmH1ENS5+2F/acZbw2lXT578PAEjOTikhIwwSDD2rbYe0WvSTqL48m4:QFJQil5PUull8PAj2gD2rcjJTqL48
TLSH
T13215AD73F288D1B6CB8F15B44532AF3B097EA922431596C7F7842D5FEC912E2963C285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wzzx2.exe

Path C:\Users\Admin\AppData\Roaming\LiteGameBox_wzzx2\wzzx2.exe
Size 3.9MB
SHA256 f39720be05f285c7c4addc52938e06f32f44316827278c2689adf634eaae8338
MD5 2ef6bb298e70642b098a97c734763e47
SHA1 dfd35b388db534dfa4ea5c91dab5bfca95d20db3
SHA512 aca51e624759f86536493349e45eeec9f78aa8cf85d35fdbb7315a59863f0d33da6c58562c2375491eb2f8988b4aae1f73a20e4c3b2ff58d8c8c9ecd27a62d3e
SSDEEP 98304:d57KJIw7A24gD2lIIvn5P7NoyRZIelWYTCbOMUB2:rdwIkqP5P7NosyejHK
TLSH
T1EF16E022BA86C132D6A641B05D7DAF3E547DBA310B3581CBB3C41D2EDD706D25A3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wzzx2.json

Path C:\Users\Admin\AppData\Roaming\LiteGameBox_wzzx2\wzzx2.json
Size 949B
SHA256 5ced76d4f8110b6379589c0fd99bbb698faa54631e2d3d047ee75460134eb262
MD5 c3e8ead67c0723e71085d2b4e3301fb6
SHA1 87f36af78eaf6b9ce38ff95fac365672316712d1
SHA512 91e9aa6d5ef2974bd8954a1fe3e14dda66038f696119ceb8da3bdc54580f9fa7937391cc68f8326f9745aae8a80fff6f9f772165782e38349f4dda834e3ee69d
TLSH
T1CC119C09D0C0CA5E6E1CDFCC64AD1BD9C3EE6145588DEDC7FB437089C1AB56412C2B0A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads