bdaejec | 5f1cf3057b14cbf58792e275bc7b2fa684a3ffd7fa02420b933371b5e37b6fff

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
Size 538KB
Sample261024-rexptacs2q
SHA256 5f1cf3057b14cbf58792e275bc7b2fa684a3ffd7fa02420b933371b5e37b6fff
MD5 4a7d1b31e284e5ea329d0a6cb7a42909
SHA1 61667b53b8416aa7a5afb758ca66d9ddb2089f93
SHA512 62ec83542e65c9c652671ef7415f2d974ab2fc3ee7b40abb595fb1f37d38055e1d37b3c243054eb6d7e75134c51b12e1fa2d3751a3fc5960248867a83fe091c0
SSDEEP 12288:hrMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V:3ZyCA8CBmn+RrNj9ay5I
TLSH
T105C49F71F7D09537D1271B788C5BA2A9A8397F102E2864467BE82C4C9F3D7C139292E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/2892-354-0x0000000000A00000-0x0000000000A09000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000800000001138c-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2892-5-0x0000000000A00000-0x0000000000A09000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2892-354-0x0000000000A00000-0x0000000000A09000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000001138c-3.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2892	ETAMmhZd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\gMavInject32.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\gOfficeC2RClient.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\gcreatedump.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpCmdRun.exe	ETAMmhZd.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA0A5.tmp	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gjavafxpackager.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gpolicytool.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\gCLVIEW.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\gIntegrator.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjavap.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gnative2ascii.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.exe.sig	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\gelevation_service.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjava.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	ETAMmhZd.exe
File created	C:\Program Files\7-Zip\g7z.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXA006.tmp	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\geqnedt32.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	ETAMmhZd.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\gaccicons.ico	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\gIntegratedOffice.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	ETAMmhZd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	ETAMmhZd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bfsvc.exe	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2516	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ETAMmhZd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ETAMmhZd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ETAMmhZd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2892	5052	2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe	89
PID 2892 wrote to memory of 2516	2892	ETAMmhZd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4a7d1b31e284e5ea329d0a6cb7a42909_darkgate_elex_gcleaner_smoke-loader_wapomi.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\ETAMmhZd.exe
  C:\Users\Admin\AppData\Local\Temp\ETAMmhZd.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\447368cd.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 538KB
SHA256 5f1cf3057b14cbf58792e275bc7b2fa684a3ffd7fa02420b933371b5e37b6fff
MD5 4a7d1b31e284e5ea329d0a6cb7a42909
SHA1 61667b53b8416aa7a5afb758ca66d9ddb2089f93
SHA512 62ec83542e65c9c652671ef7415f2d974ab2fc3ee7b40abb595fb1f37d38055e1d37b3c243054eb6d7e75134c51b12e1fa2d3751a3fc5960248867a83fe091c0
SSDEEP 12288:hrMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V:3ZyCA8CBmn+RrNj9ay5I
TLSH
T105C49F71F7D09537D1271B788C5BA2A9A8397F102E2864467BE82C4C9F3D7C139292E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 31KB
SHA256 84bc898f6d29ee5180909f87e809465f9bc4e0e41dc7a61fda7f2df30d088e75
MD5 ccd07bda92d7851f84aaa9eec4541072
SHA1 dcffb71d3696e5aacbaf9da0083c623ce2a3283b
SHA512 f40911f490a1a05ae2a50baedd8c2952e5d24c0b04184418f3bd21296274f16aba060fe81a88463e4e7d9b950c989a714d9655f6697eb1ef189402fb5c1905c3
SSDEEP 768:6WQ3655Kv1KjqY1MNHERQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHEWGCq2iW7z
TLSH
T112E28D53CF9054F6E7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34640E862257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g7zG.ico

Path C:\Program Files\7-Zip\g7zG.ico
Size 4KB
SHA256 12974a2f4099c7f1bc3de5e21d66702bcfe65087a52d50a79808762a5c224007
MD5 da6a16aa00b293576147de4af60339a5
SHA1 079c279b68fd00e3f885d405f9dec88c43d22b84
SHA512 9e22db6d05708fedfd538e516acc935d5cc4c7ca986381c415c91b2401ffd15192d48027c9331c2409eca945c0feee8ee2c24e2fb9d391c1092103b76a20de52
SSDEEP 12:G/HH0Hk0Hk0EHE0EHE0EEH0E300EUX0U3k0knk003k0En0En030303HHHJt:GI
TLSH
T1629102417300D05CC1440730CC02C2FA01497C11CD74110334C13F0F39321840835640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gOfficeC2RClient.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\gOfficeC2RClient.ico
Size 4KB
SHA256 a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c
MD5 3ea9bcbc01e1a652de5a6fc291a66d1a
SHA1 aee490d53ee201879dff37503a0796c77642a792
SHA512 7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501
SSDEEP 48:r2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:r6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T12291553EA718B8B0F94E6DB1236FC064501E7504141BCDA6B1A9FCB07F92CEA40147CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gsetup.ico

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\gsetup.ico
Size 4KB
SHA256 7718d80734b00aebdd462541a6c305be9872d2219559dac681b0de12523668f3
MD5 17adcbbd69706854b462c6afd94665a2
SHA1 0b9b172c2dba803cad33ceeecdcb60a0c977a7da
SHA512 8ac06acf5277ef8a6c6fc88596155c67f2d6ac26b62a9d0091b931a661ad208dfb7bc8dcb0cf25fd486d0b745621baba641e0742bc0abba5cce819206bb29d42
SSDEEP 12:Gf0HknXHULUEA/EADHEE330AT0UwstE0UQs55+UkQs55OH0AOz2q40zUazn0Xr5C:GfznUQsfexn2Und
TLSH
T1C89105816E3EDAF5C8440130CB4F8FF109294C52F114521387B2BDBEFEB9B44E61A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gjavaw.ico

Path C:\Program Files\Java\jdk-1.8\bin\gjavaw.ico
Size 4KB
SHA256 611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5
MD5 38b41d03e9dfcbbd08210c5f0b50ba71
SHA1 2fbfde75ce9fe8423d8e7720bf7408cedcb57a70
SHA512 ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9
SSDEEP 96:GxZnQuikS0jj8KJy9QhT8PB5CXMaTFgL3n:GxZQuiQjruQ65wXMWA
TLSH
T10391ABB2F18998D5DC566D73453EAC7250E37EAD89E68A0D109F73158AF338110E6E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmisc.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\gmisc.ico
Size 4KB
SHA256 3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05
MD5 fc27f73816c9f640d800cdc1c9294751
SHA1 e6c3d8835d1de4e9606e5588e741cd1be27398f6
SHA512 9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4
SSDEEP 12:GFXAOAO9XAkXRABEXAOAOANXAO6qOyvOyYvOy44o4v44PQ91pnSqu:GiB7GABbBBa1qlvlYvl44o4v44PQP/u
TLSH
T171916492593E9DF8C1550930C99FCFA14E341C1744505542E7F2AECF9EB1B50F61B668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmisc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\gmisc.exe
Size 1014KB
SHA256 0f83b4e9f1c4cb2e017fd753f8735b27bace7f51e366ee6ed25fdd8df1e9e13c
MD5 8fb5e78e2c4cfe83fefe4e319b521726
SHA1 7a1e57ebf6d479f3d972cc7a851eaaca66a9ddaa
SHA512 135e9345ecddced2f81a4e4c9aadeae5aa4ae0fb5c4012f3aec25a4586a6294dcbb01688b921365f64b282c57a59e783fa805174328587fbe009f9d0b731cdff
SSDEEP 3072:U8yTUawK12P04ti0o5gmQNJDJnJG20FxPlJPJSS1Mlt:U8s4wqmQN59wtSSit
TLSH
T15725B5136D0EAB76D64F3E709C01D7E916007F0098173D662DC6BEAEF6B29DA7A0D124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MJOBZ9FO\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

30B165BC.exe

Path C:\Users\Admin\AppData\Local\Temp\30B165BC.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

447368cd.bat

Path C:\Users\Admin\AppData\Local\Temp\447368cd.bat
Size 191B
SHA256 2ab1956cd8802f8965fd50c7a40bfde42c5ccd071061dd9c86246dac755d8db2
MD5 6b80b69ad8e8bfafcbe4023c7ce2d81e
SHA1 e1e732f2f9cdd2a1c0ff918daae5935df325569e
SHA512 568d7b49b37e0e2998ffd90c7ef502abea96ff993e9dbee3426898524b0a416b5792538828fdc24c45d986d65d720194454e0ce3b348d761128acb8a2ab6d7bf
TLSH
T198C022188182C29E0561003B16E0204CC02008A83B493B105B21840CA0A680EB9CB322
MD5 SHA1 SHA512 TLSH

Submit Download

ETAMmhZd.exe

Path C:\Users\Admin\AppData\Local\Temp\ETAMmhZd.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2892-5-0x0000000000A00000-0x0000000000A09000-memory.dmp

Download

memory/2892-354-0x0000000000A00000-0x0000000000A09000-memory.dmp

Download

memory/5052-8-0x000000000047B000-0x000000000047C000-memory.dmp

Download

memory/5052-252-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/5052-353-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/5052-0-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/5052-9-0x0000000000400000-0x0000000000492000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads