833a2095e4b29db755c2e4a436bdbc3b30cbc370a03c2374be8f7b830f5a74a0

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.exe
Size 25.0MB
Sample261022-3eq3tavwas
SHA256 833a2095e4b29db755c2e4a436bdbc3b30cbc370a03c2374be8f7b830f5a74a0
MD5 6626a2a66568c11bac3945604abbb3db
SHA1 cffd87ad0eb0d8d44fff0b4f47fed9f7aae41d89
SHA512 0be86ec73b8a3bf15e25ac95a738c3acf4c98d8396454a33a3d65e5a0c077b09ed942597628fbd8a073f81880179b5518e891a5ef4ae0bdbf7cca330fc160026
SSDEEP 393216:h/32q08rbMFeJSZhkjN9frvpVK+MJKN53cv7f+z4ShyxegIJFfZy:kzAqMyhkDfrvpc+MeRS7+zryxeg4FfM
TLSH
T1E44733F3DE6400FDC42A9E7580938BC58E263E7899F09546BEF0F65C6B329841F39991
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3544 created 3760	3544	elevation_service.exe	82

Detects Windows executables referencing non-Windows User-Agents 11 IoCs

resource	yara_rule
behavioral2/memory/568-352-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-427-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-428-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-429-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-430-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-449-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-450-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-451-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-456-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-458-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/568-457-0x000001464A970000-0x000001464DBE1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4876	attrib.exe
868	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp
1328	Teamsmovements1308.exe
1112	Teamsmovements1308.exe
4340	Teamsmovements1308.exe
2400	Teamsmovements1308.exe

Loads dropped DLL 4 IoCs

pid	Process
1328	Teamsmovements1308.exe
1112	Teamsmovements1308.exe
4340	Teamsmovements1308.exe
2400	Teamsmovements1308.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4736	icacls.exe
5824	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4236	cmd.exe
3708	cmd.exe
1528	cmd.exe
1960	cmd.exe
2632	cmd.exe
6116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x0000000000441000-memory.dmp	innosetup
behavioral2/memory/4536-149-0x0000000000400000-0x0000000000441000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	55	Go-http-client/1.1
HTTP User-Agent header	235	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4764	taskkill.exe
6116	taskkill.exe
2780	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp
4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp
1328	Teamsmovements1308.exe
1328	Teamsmovements1308.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
568	waitfor.exe
568	waitfor.exe
1112	Teamsmovements1308.exe
1112	Teamsmovements1308.exe
568	waitfor.exe
568	waitfor.exe
4340	Teamsmovements1308.exe
4340	Teamsmovements1308.exe
568	waitfor.exe
568	waitfor.exe
2400	Teamsmovements1308.exe
2400	Teamsmovements1308.exe

Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1328	Teamsmovements1308.exe
3544	elevation_service.exe
3544	elevation_service.exe
1112	Teamsmovements1308.exe
4340	Teamsmovements1308.exe
2400	Teamsmovements1308.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	1328	Teamsmovements1308.exe
Token: SeShutdownPrivilege	3544	elevation_service.exe
Token: SeShutdownPrivilege	568	waitfor.exe
Token: SeDebugPrivilege	568	waitfor.exe
Token: SeDebugPrivilege	568	waitfor.exe
Token: SeBackupPrivilege	3084	vssvc.exe
Token: SeRestorePrivilege	3084	vssvc.exe
Token: SeAuditPrivilege	3084	vssvc.exe
Token: SeDebugPrivilege	1112	Teamsmovements1308.exe
Token: SeDebugPrivilege	4340	Teamsmovements1308.exe
Token: SeDebugPrivilege	2400	Teamsmovements1308.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
568	waitfor.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4172	4536	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.exe	90
PID 4172 wrote to memory of 4764	4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp	91
PID 4172 wrote to memory of 6116	4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp	94
PID 4172 wrote to memory of 2780	4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp	96
PID 4172 wrote to memory of 1328	4172	2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp	98
PID 3544 wrote to memory of 4236	3544	elevation_service.exe	101
PID 4236 wrote to memory of 568	4236	cmd.exe	103
PID 3544 wrote to memory of 3708	3544	elevation_service.exe	104
PID 3708 wrote to memory of 4736	3708	cmd.exe	106
PID 3544 wrote to memory of 1528	3544	elevation_service.exe	107
PID 1528 wrote to memory of 5824	1528	cmd.exe	109
PID 3544 wrote to memory of 4876	3544	elevation_service.exe	110
PID 3544 wrote to memory of 868	3544	elevation_service.exe	112
PID 3544 wrote to memory of 1224	3544	elevation_service.exe	114
PID 568 wrote to memory of 5440	568	waitfor.exe	116
PID 568 wrote to memory of 4884	568	waitfor.exe	117
PID 1960 wrote to memory of 1112	1960	cmd.exe	124
PID 2632 wrote to memory of 4340	2632	cmd.exe	127
PID 6116 wrote to memory of 2400	6116	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4876	attrib.exe
868	attrib.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3760
- C:\Users\Admin\AppData\Local\Temp\2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Users\Admin\AppData\Local\Temp\is-MUVM9.tmp\2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-MUVM9.tmp\2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp" /SL5="$501AC,25860775,223744,C:\Users\Admin\AppData\Local\Temp\2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Teamsmovements1308.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Teamsmovements1308.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6116
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Teamsmovements1308.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe
      "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:5440
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:4736
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:5824
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4876
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:868
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ARYRBYsffjasqhCCGcpFcHXt /tr "cmd /c cd /d \"C:\Drivers\ImpreciseShowdown\" && start \"\" \"C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1224

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\ImpreciseShowdown" && start "" "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe
  "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1112

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\ImpreciseShowdown" && start "" "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe
  "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4340

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\ImpreciseShowdown" && start "" "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe
  "C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2400

C:\Windows\system32\schtasks.exe
schtasks /query /tn ARYRBYsffjasqhCCGcpFcHXt
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Getaway-Defend-4115.r2cU

Path C:\Drivers\ImpreciseShowdown\Getaway-Defend-4115.r2cU
Size 4.4MB
SHA256 cb641e5571c35924c657d4e351dfc8044a021c24ebfc69f586074e9cbd940922
MD5 47972d3865572ec502a9d6a3a9f2f595
SHA1 a66018dacc6ccd9276635912cf7a15074d472d2c
SHA512 d01b14bf871d63c9c922acc5f9e8b69191223f5247176cd65f5b807d34fd9890f7c2f01878fc5a0474cb0215af392dcdc8cd0455f99d6d2a5a29305f1c57c26f
SSDEEP 49152:WaYDYyZZNwWANJCDQjkoDAIvbXCxnZcpwUxTm:WaYDYyqjfDrOxnZcpwf
TLSH
T1E326CF312251AA19E13F471AE1F85E1CD67C2649977A8A8C5E13FEF22E85701FF3819C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Teamsmovements1308.exe

Path C:\Drivers\ImpreciseShowdown\Teamsmovements1308.exe
Size 503KB
SHA256 913671431a9e9aba4a85ee21d9e3386dab40ba4824f2b8bc3ecae5b48afde3af
MD5 dded1e60412106dd238b5a731afcde3c
SHA1 86d7dffd1eb8c1bd6368f09d6e4962ac366122ed
SHA512 54f5956b78e2e6322843532901368559550b626fb6b9246fd2844a0875e0a45eb090e4153003ddcf935d152c63570e637c6db32b086cdc160234145b6795db79
SSDEEP 6144:LyqZFjTvQlOVT0INczLL8k6OI2tYjKJh4/VfHcvqd/Nwt20kC7TzjiiiiiiiiiiY:O6FYONNczLgoI9j04/RHSkCDc
TLSH
T151B47B51E76804F8D462D23880524E4AD7B27C3D67B196CF26F4B9662F33EC64C79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KDxL4E.ico

Path C:\Drivers\Loseplanned8133\KDxL4E.ico
Size 106KB
SHA256 fa6c9fc9d04c295e64576ab3bd2fc5be1c50fba06a7dc8876b8778a762515ea1
MD5 973834e32e84e20fd3eccd72d1651e76
SHA1 db10125f010d285ea07f2297add7c0e39eb6e73e
SHA512 3f5cb90755a0ef03f3da8fb49af4b5d8a28e40a5cc949305e13eaa702f77a0c80cf412f35e9e6e9f1f5c2b6f7ddfb349ff5380d24eaf606c7af229bf306a5528
SSDEEP 384:jKNvPQ18gAm2rh0dNXfIuNf0RBPZa1BbDG4fBdwl7SqdN/kGPPDm3yvL:jKp3siBBaI9Nkaa3K
TLSH
T1F9B3FEF7ED1490EEC82E8E72A6CB6FD90D05BFB9CE308912F9C1F29597619242C085D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 16KB
SHA256 bc97bdc3acd73d6dbba0663440cfb9b5c0c3db8e06a9ccc00041d978445e2204
MD5 d406002884c847ae590decb8ed81ee7d
SHA1 3afb3b434843f1a4440766cf9a52ea7caa55875a
SHA512 3ca15e29f982a7ed992e1af3766c7dfba36bb0c60e1a075106e0576ebc1a79c736771d473d21399b003b8489a710b64695dae960cd5ff15fc755075cef779d45
SSDEEP 384:MCsSbSbBCR0GFCvBkplOxFs5/sYanWiofHMERdK8pDrjsg:MjSbSbAeGF38FMrfHhI8pDR
TLSH
T1C472D067390B7BF0F149441A2A11D157F9C682C7F5E6417BC2B283CA6F85CA0C6D54FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 33KB
SHA256 6511cf6e8421e0d867a11334ce94bb62e463c5912f180f6131c6fe5a35b00898
MD5 25426ee2f37f74e962bd485d6dcc3c31
SHA1 d52b66791a548ad3cbe631bab32c70940b0be777
SHA512 7fb398657a79ed9b680db055bac8cf32d1cfe2255769ada06553e07d87b7aaa62b3d089eb5e9e108785187ac85a3fdba0761b27e280f3456d5f448aa27eb1c1b
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ53:LbSbANHI8N4JCSuw53
TLSH
T13BE2E053AA27FAF1A13A4518B801C647FAC4C1F7F59AC135CD7282D44F96872C2EA09F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 39KB
SHA256 1c26bf801b23303e614bb0b14f0a2b8eb1e0d3b3e0507217e854514c4a7544de
MD5 a8af3fb0db8f148d492b2ac2bf57bc09
SHA1 13279b090a6c845cc18631bf71bc99bf13cb5e94
SHA512 a71257a874249bc6298ea38430b88ef2968052f84f6941ed11f54cf9a298fa39e266f9c31a9acb1a7fd8a6a3ea82013a6d2cbf799874df8fb49057d56dd3c61e
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ59PHrdf/IqJ:LbSbANHI8N4JCSuw59PHF
TLSH
T1E303F123AB53FEE0B2254914B401D197F6C4C1E7F55AC176EDB291D48F624A1CBEA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 3ded18d68a473b88a3204a9d9f2ae9474fbb8e64fff88d55254e1dae14283a4e
MD5 4f9643670c86dedc380b8c5969e038e7
SHA1 efabc92697a2563fc55965a42a0c21f4307349b7
SHA512 b1cae6f078b20f2a3ab0ca8b019688da75116fe7eea3ba2729382f64863dafe2b2836b666e25a0392583f10b4425634555d28ee1cdf68be1baa7ce07ebe91baa
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ59PHrdf/IqqKw:LbSbANHI8N4JCSuw59PHPw
TLSH
T1AE13F163AB53FEE0A2294915B001C197F6C4C1E7B556C176DDB292D4CF524B2CBDD08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 d6ff3d986da4ba23a21f207b0d81f79ec8697161abd9f8a0c84c1569ee317f59
MD5 bee5961aed6c738494765acd5db23901
SHA1 4f45e6746830e8cef808d6e099cb5dec11d85f61
SHA512 e17075234b06a3c7f3cdc14f3aa52f4ac59e33b0d1c0873d1517ef182a098db80a9ede4f768850c303650cdb2e80a8a14c00f6e73c2366f6fe47a9af9b3c05fe
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ59PHrdf/IqqKU76T:LbSbANHI8N4JCSuw59PHPtT
TLSH
T1BD13F123EB53FEF0A2694915B001C257F6C8C1E7BA4AC176DD6295D48F614A1CBEE08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 1KB
SHA256 39c0e04cbc19243a11219e7e114298606530af7e63e324fb4448c28429fb8ded
MD5 df316e0ed0f7466c98f1978e8686860e
SHA1 f92b3e78f3953282da464e77e3a6d62cba97296f
SHA512 665bde7842066f5e14be916919ab89ca787fc26653bd92a0555db2838d180bd4c5abd22bdda1adb4c3e84225b690fe4fd8d1e43945556ca556b8ed3c7fe4e7fd
TLSH
T10A21B7C7F21139A4BDB5003A2AFAA00BDEFCA1D5CD6F07F2D20D44C406958464EC2173
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 11fc26a5207167eba341fdd5e7333b4a92581345098e1e268d09447af95ea7e4
MD5 9ee28c59a3ff89610abaa2b4fee3bbd8
SHA1 711b489168d3247e679d1d905cb3ae7a4606ae1e
SHA512 91ae4bac9baf370c42b703a7cff8cc0e16011d7af888043afd3b0d95e647e0fd77878868eaf3e33d78d99da264c350f837ff9424b34ecb82782253ba1695287d
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ59PHrdf/IqqKU76IV:LbSbANHI8N4JCSuw59PHPtIV
TLSH
T10313F163EB53FEF0A2290915B401C257F6C8C1EBB949C176DD6291D4CF614A2CBEE48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 50KB
SHA256 617969d793bea9d1188afda9f46668348615970fdd3a1e5ced272549dcadead5
MD5 0613a109f837e3bda44ee0a1ba4c19c2
SHA1 2d37b997585005866f0879e402eea0c9a524cd59
SHA512 9704b9d73084d3ba23789c605e60f1fafed019deae95ae3d6e324717b56eebd6f6437a0c708bf8131917e670a1051e19f4fb92b4ba35545edd2df10090e021d4
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ59PHrdf/IqqKU76IdJGYV4JwGu:LbSbANHI8N4JCSuw59PHPtIdJGY4JwGu
TLSH
T1A333F177BB13FAF466694945A501C992F5C8D0E7B489C072D962C2E48F600A3DFDA48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 51KB
SHA256 b38a5f7d17012e51d09722a912a76e0a254b69712868d9823c6794fe74d0d343
MD5 51be1eafc9b82ccc4fed28043e500528
SHA1 a0958a57ffadc61c993e9fd5240233b6cb40b39b
SHA512 7ef8e040cd99049c1e6a56155073a137fa0bc69ec67afd0e07ae87cdae330fd69f5fd5ae89a9718bcb0a0941f114fae3da555fb5e88337d2ddaef1eca8c11241
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQQ59PHrdf/IqqKU76IdJGYV4JwGD:LbSbANHI8N4JCSuw59PHPtIdJGY4JwGD
TLSH
T17933F177FB13FEF0A6694945A501C996F5CCD0EBB446C0B1D962C2E48F600A2DFDA48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 55KB
SHA256 0eadb6076835cb8625b88841b77534252ff4977373c6719ecbbedc5d3183ebaa
MD5 df73590bed926fea234898209764360b
SHA1 74c34a44ac42cdbaddacc27300aee38c0e692308
SHA512 edd9545be9281edf39266991dc84f1cba81296147d048aa297cc5ee0862baae34eb128cecc973710d22ae292b228a08952c549d9c180fd4d7e9de2b7754189de
SSDEEP 1536:LbSbANHI8N4JCSuw59PHPtIdJGY4JwGOFF:6MNHI8NvSuw59Pv4kYqwGU
TLSH
T1DD43F263BB13F9F1A66959859901C853F5C8D0E7F48AC0B1D962D1D44F700A2DBEE48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 77KB
SHA256 fa792790e0d0e2b9916cd8d32745b150873ac2a9f7ed7fd45a98fcd00ee26f28
MD5 3662ddf7f8439897213e6e54f26b6667
SHA1 37c7e9fb43d0923ee59d118a4066637e84409f6b
SHA512 7dcb45f55bc06b20aed5992f12b2adde7f03fa7d13f7150bd89041ff34cf480383f047c4d1730f9620a7afea7708bbbc2e2c80ce2f35d8e812c43e889a911e56
SSDEEP 1536:LbSbANHI8N4JCSuw59PHPtIdJGY4JwGOFCyDdhWb1Dtg/e8lqRP:6MNHI8NvSuw59Pv4kYqwGDyDXys28kJ
TLSH
T1DF730267FB63FEE0A5A55B54D840C8A6F6C4D0D2B8C78471C99385D44E900E3DBEF88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 102KB
SHA256 029f3b8aca9cbc3e880a9968e5afeb987d257acb69be061a5110d426b3919280
MD5 a3cde0ad6e300950f5f501df20c90b18
SHA1 63d12a931e42de804b8b61f2f3865a36adac4918
SHA512 e86f1efccba19e3d2a70d0c34fc64389ef9b329d95a0361d1e886338f4a667fa76cbe917c88acc404517e639ba88ecbc83be26e7f8504af5225f518fe16d21fe
SSDEEP 3072:6MNHI8NvSuw59Pv4kYqwGDyDXys28kMiOpoJvapfPm:6M684uw593TYqwG6XVkMiCSyfu
TLSH
T154A30223A753FFD0A5A65E519841CC76F2C8D0E279C78071D6A3D5E84E800E2D6EF88B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 16KB
SHA256 b5d5536500a2fa17610b45bfdd69db66c7918ef8a78f9b6ec56a3c7fc9203441
MD5 d05254e61ef83cee42ecdc3dcf925c7e
SHA1 38d02d3c13d221eb35ae0ea4cb637947113d323b
SHA512 e684500e15b2cbc16e125d8d324a5ff8715f94ff1164517a270d25167a8316fcf94c5a7095e5c432074b13dcf2b6d82473e36c62f3663c8af35f4330ea5ea7a0
SSDEEP 384:MCsSbSbBCR0GFCvBkplOxFs5/sYanWiofHMERdK8pDrjs4:MjSbSbAeGF38FMrfHhI8pDP
TLSH
T13472D05B390B7BF0F15995162A01D157F5C682C7F6E241BBC6B283CA6F85CA086C50FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 33KB
SHA256 728a498f86a63eb0d27b7cc637013d7e2dfe65bed1ca206a2ad2cc409cac16ab
MD5 f4a8fc793c32bd5c5ecf987227405f90
SHA1 d9bfc70677db0cf5eda63a8a3fc5d2009db71427
SHA512 5fb99acc72e8f2953060c33819b12151c6f11ff889f3ce4b82c2521d0e0eea7bb496e29349693a5f0fe3f68b40c7c5bdc660275d3ce4c8633cc5173aaac339dc
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZY:LbSbANHI8N4JCKuMRZY
TLSH
T1F0F2F053AB17F9F1A12A4514B401D683FAC4C1F7F55AC135DD7282948FA6472C2EA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 38KB
SHA256 ea817081ab4c2a286220456eebdfbb6d4fe5ba44c81565f938b0b60ad5d2e98e
MD5 4caf71cacd599383749cee78fee558dc
SHA1 fe8abd75ca7450f6c920f88f9334babaa370ce1f
SHA512 c29cf6d52c3d3c5f3af948447749739fb6905b34213fd2d786a245076c15cd474c1429019f007df8e2c43f2c370e57e3dbd0dc7c1f63f60a60383da0ac53a437
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZZjrdf/Iqo:LbSbANHI8N4JCKuMRZZj8
TLSH
T1DE03F163AB57FEE0B2254514F401D143F6C4C1EBB55AC175EDA292D48FA24A2C7EA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 41KB
SHA256 1e0d7217d63fbda966b2505a38178c801017696c3cf84a716cd610e6becd5651
MD5 5e1fca3d5b9f6e6175de6bec82993bd4
SHA1 d8d08d03a4561809573a8808f6b7e89c24ce0fa7
SHA512 5488626950bdbf7d36ab5e62151d69b53ace57b4cfb3a597e232f7253e5367d267f8f1c351992097f10c7919c79b5f94a5399f693db52b08be421046702ae018
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZZjrdf/IqqKw:LbSbANHI8N4JCKuMRZZjPw
TLSH
T1FD13F163AB53FEE0A2294915B001C197F6C4C1E7B556C176DDB292D4CF524B2CBDD08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 43KB
SHA256 9640b53ea2f1be4f9194261fd50e4aac383d53376643b49dbddc3a35a158aa9e
MD5 a1aa0c30a7c4fa1da620b6424501886a
SHA1 ba11385024020126e020d17f15daaa86291358f4
SHA512 8ecb3126168f2acc1c967068debd456420bb7027ce4203fda46df3d58944ad2236d27a5ff5cfd79c6199811016e1807b5897897c428266e4a90a276d3208ee92
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZZjrdf/IqqKU76T:LbSbANHI8N4JCKuMRZZjPtT
TLSH
T1F513F123EB53FEF0A2694915B001C257F6C8C1E7BA4AC176DD6295D48F614A1CBEE08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 43KB
SHA256 3a49dfc04dd6880ebe20c88a5b6c681c049ac4ae94ec4b71051039f7b07ef3b8
MD5 70a4f66c0719009823398d6e33b33255
SHA1 c29c6b60bebb79163dacb1fd6d352c6f1685fd35
SHA512 216008ba03b36ba1e1075174ffe134d6ff99c334a98fcd9adbe5db1716c45b3a20963f281518497f90a18bd487be889ed76aa90fd176f40c7d0cbe03de858912
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZZjrdf/IqqKU76IV:LbSbANHI8N4JCKuMRZZjPtIV
TLSH
T18713F163EB53FEF0A2290915B401C257F6C8C1EBB949C176DD6291D4CF614A2CBEE48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 48KB
SHA256 3383720f47fe9cc71b038fef3e8b7edba5998283f6ec04e74666e6e2a4324a84
MD5 dd49383a7344995a1f658ce8b018402e
SHA1 77e603d44b99cd8a901288435f7b4611c0198720
SHA512 4c0acb9699793cdb8230767cfdc18108bddaa16e92f66eaa1adb77dad7b6b6b459450356b6b558b9923f4d77633affded055abea3ddc0878ce29517d01c51a6a
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZZjrdf/IqqKU76IdJGYV4JwGN:LbSbANHI8N4JCKuMRZZjPtIdJGY4JwGN
TLSH
T12123F173FB53FAF062694945A501C597F2C8C1EBB44AC072D97282E48F600A2DBDA48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 51KB
SHA256 306fe4450f02fb786d1c0981422fe07352a83bb7aaf9febf1e7f9e299ab7f0b6
MD5 ff370b281f7e4e089b775ee4a236cf78
SHA1 1a4f84159e667fdf4b951e927e76045f0a2baa11
SHA512 e01a967e75425424c4c4d1c50de08a41ffe968c354a12a42b9dd41200270719a5759f14e03ff07a9bac77660d46aaed7ff62e6f2f94ed006f313c66e77fe4c64
SSDEEP 768:MjSbSbAeGF38FMrfHhI8pD5t/AU0Chazu8uoQsRZZjrdf/IqqKU76IdJGYV4JwGD:LbSbANHI8N4JCKuMRZZjPtIdJGY4JwGD
TLSH
T1DB33F177FB13FEF0A6694945A501C996F5CCD0EBB446C0B1D962C2E48F600A2DFDA48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 4ab8f4253b035978a9b655a707908866ddb2ad595ad2aa04d4cb8f0071576072
MD5 3a276679035cc2af29c15b33fee8cc03
SHA1 9f22251811b0c9119572b9e21c58ecd8629e84ba
SHA512 cec7928a2ba3d968101f0e1da6a1458f53bdefdd8dd5d11b8e26b2b9c07a32fd2fabc3f01105f2a2575838a9adf5affffa794bec6fe53af55aa7d6c518b516d3
TLSH
T1A1411A57E21135A4EEB505191BBAB05BFAF482CADD2E17FBD21940894E6DD110DC1163
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 55KB
SHA256 71ef5a1a1ec7532376fc04a968eae50120ed3bd474a4954d23401ffdc655ae09
MD5 063842f002344ec0fa60dc0f366c8da2
SHA1 f6f1ff332700a7cdce99b680e69c0ad499aebeab
SHA512 c986500adf4cd409da75c86b833f8d223c4b65f2c9a6efc5c8e9a77b2b656181d790a42fcfa3088131ff3d1024adf34d266283340807139065028ecce863de16
SSDEEP 1536:LbSbANHI8N4JCKuMRZZjPtIdJGY4JwGOE:6MNHI8NvKuMRZZT4kYqwGV
TLSH
T1F043F267FB13F9F1A66959959901C893F5C8D0E7B486C0B1C9A2C1E44F700A2DFEE48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 d8bfed58a14f7986a195ac7afee855651918277b2a7f35543972982fac08a114
MD5 200d01bb2a404e7577473665bca39fc3
SHA1 f66d071325e91fb1b91493c9b9f6b27fdb4c1a2e
SHA512 311da439c57c4de427edd3e97773c66d56a9e588faba44ab1d95c165efedb1d2cd34aab337f2a88131d534cd04490e2bdc203898d2c5165736251b93e7f24b87
TLSH
T165515D93F10238B4E939211D177AA04BF9F581C7AD0D1BFA821C42CA0A5DC250DC52A3
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 d73757f0ef138a849a264c3a49ac075ce698bbaad84b4aefc65e946f0027d84a
MD5 d4b6778c2266350d69f103df19baac96
SHA1 49a6e34c9919735f61c008fdbec71bd9405002b8
SHA512 6fae051beece141f7b60d0f367e0e24d76ef9fa941718c15ad70ff9ab36ded0a3a25aab437004c2cf687334bc07be3dd2338280fe2a94ccb79907409bd7abd14
TLSH
T15E616D57F1467DE4FD24113B3626B006F9F9C897BD2A16B5823847C60B9CCA90DC90B3
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 3cc601f8b9d0f08c95e71e3c5c8d5baf002ae1edd80ad4058c8840aaecfab653
MD5 bae7fa3327716767bdcbcb954092da1c
SHA1 326ff072e8f2eb826a6df524fb315fb822f4561b
SHA512 868625f0f10df44ffe89c7390aac1ad4d0d1cfca545d84877417b236380315fb9b5355114f59aff0b63ac2b0503430191812373cd9380507a5808c57e4132321
TLSH
T1E4718D97B6013DE4EE14203A2A25F006FAF9C9A2AE5D1275417803C51FDCC9D0EC90F3
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 ef16848a63fbc728460f50ab0b6d419eb44271928d7de9593585c1d98c8ffa27
MD5 648643420813e66416a960a204a908a4
SHA1 6da728aa7ca48fc15c74300ba2b76951263cd3fe
SHA512 a08bc0769e2b79ed36f21dd1a2d8345667da7eea53a6187c3fd2212aa6f61dc67167853556b7bc61dd3fbd5a6946dffdc6d0f1d84003262da4979ea6b417b138
TLSH
T198817ED7B5453EE1EA1525692625B006B6F8C592AE1D05B6C26843C52BD8C9C0ECA0E3
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 77KB
SHA256 7d97112b832084fe7932d3bbc046a44a42d42e0527996eb8ecdae13e84587591
MD5 79b496b1c424c05b4f688b9296dd6d2e
SHA1 376fb2dceab2c2169faece13bc736c1a0c900a04
SHA512 fd12610bfa3029ef603434194039fdda9df78a36002128b187729457622521c99223febadf81749c0c37bc843cd7be0f5d1616a41dc336b65f52f52c70f472b6
SSDEEP 1536:LbSbANHI8N4JCKuMRZZjPtIdJGY4JwGOFCyDdhWb1Dtg/e8lqRP:6MNHI8NvKuMRZZT4kYqwGDyDXys28kJ
TLSH
T166730267FB63FEE0A5A55B54D840C8A6F6C4D0D2B8C78471C99385D44E900E3DBEF88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 4KB
SHA256 f0ae83f3a6e1be03970ca995a251608d4e67c3a2819454f1d964349e0c8e62dd
MD5 c40efc25a0375f2ed872f04872ccf334
SHA1 121ae6d0c765679204af6dc64c3b70a281d080ba
SHA512 9013f9884c2792634e65544e915713383f068c923d5b6406af7e5c7503536579f37e47f1dbba36d706e1cf7983647e1d840c28d77caa07b485d14cf5c1a72028
SSDEEP 96:QlPKlnbRmg8SiAZkuSAOL2FV+rmQoPp671LfRm3FogV0oXYB5+puc:QlPKl1sSdZzSACBrmQoh0GFN0ooB5+pB
TLSH
T122A1AF87B9493DE0EA5554253636A057B2FCC492F9290172C36813C17BDDCD90FC51E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 103KB
SHA256 c3f24cb4fea27c1498a21732ad70d4200434aa8362d77235c5f778a1234e1ec1
MD5 f60cd0b81ffd3bf5c0e66022e7a204ec
SHA1 478653ed8a8ed68f2798c03accda5b974d30919b
SHA512 a5862616f34ea23b4ed8f977da108a332ac49369e1a98666f007b1a51394faec926b82f75c0a0f3408090d3fd745800bb09f5b75817a34855d249abda8a8530e
SSDEEP 3072:6MNHI8NvKuMRZZT4kYqwGDyDXys28kMiOpoJvapfP2:6M68guMRZ9TYqwG6XVkMiCSyfO
TLSH
T148A30223AB63FFD0A5A65A519841CC76F3C8D0E27DC78071D693D5E84E800E6D6EE84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-JM384.tmp

Path C:\Drivers\exposegumming34\is-JM384.tmp
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MUVM9.tmp\2026-10-21_6626a2a66568c11bac3945604abbb3db_cobalt-strike_darkgate_elex_gcleaner_hijackloader_icedid.tmp
Size 1.2MB
SHA256 892fff98fdc60d2baaff6c38cefc14de5575a81b7593144806500c60329cf231
MD5 690b71c9c40b9afedbb535a36fe26fca
SHA1 f9756e7755b1a8d3eeeff59cf56db946e32052e8
SHA512 cb0323caa2075ae212dcfefe4d3f7cf7301b32c5d0141107c2f74ed18c68c3b3ee821b1ad284cf7c5f3bff8b90fdc113883add5f3785778c5470c2e6c96f368c
SSDEEP 24576:3EZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsye37x9n1:0dmbjTKlD00edP
TLSH
T18D4507E3EF918437D4761E359D6B86D45C267E202E74984A7EF8FE0C4E78A407C39292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 78KB
SHA256 778412b81d2d1b42a8394bd7920506224afb565e1159933f7366fed1fcc7891c
MD5 5c64b625cea69c9aaf959048a4af9804
SHA1 541d6eab558dfc00123a8b46de4499378850d33c
SHA512 97df48950e77152151459d3dc9591239b592bbe07d69c07abc03405b48bb50d4c80f2a931e741ca2c5cda090e74f490392fb71df0e2dc2188433d8eed40a5bdc
SSDEEP 1536:NOaPh/nzFYMgqy/492ESY4u4+UCk/SivFCY4Y+B3nkkqKI52UYNlgnE:8aVzBbGofSttxjSGYY+BhTTfgnE
TLSH
T1938302E948ED2FC1FFBBF0CA92689986275440D66818B0777C3D7804320A7475ABF5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-458-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-451-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-430-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-449-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-450-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-428-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-427-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-334-0x0000014649760000-0x000001464A968000-memory.dmp

Download

memory/568-456-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-429-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-457-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/568-352-0x000001464A970000-0x000001464DBE1000-memory.dmp

Download

memory/1112-497-0x00000211F1140000-0x00000211F136E000-memory.dmp

Download

memory/1328-35-0x0000017767D00000-0x0000017767F2E000-memory.dmp

Download

memory/2400-980-0x00000212E25A0000-0x00000212E27CE000-memory.dmp

Download

memory/3544-361-0x0000022E64630000-0x0000022E6471C000-memory.dmp

Download

memory/3544-239-0x0000022E64630000-0x0000022E6471C000-memory.dmp

Download

memory/3544-210-0x0000022E64630000-0x0000022E6471C000-memory.dmp

Download

memory/3544-184-0x0000022E64630000-0x0000022E6471C000-memory.dmp

Download

memory/3544-182-0x0000022E64540000-0x0000022E6462A000-memory.dmp

Download

memory/3544-289-0x0000022E64630000-0x0000022E6471C000-memory.dmp

Download

memory/4172-148-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/4172-6-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/4340-754-0x0000020D6EBA0000-0x0000020D6EDCE000-memory.dmp

Download

memory/4536-149-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4536-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download