Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 08:51
Behavioral task
behavioral1
Sample
2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe
- Size 1.2MB
- Sample261104-ksemtsvs7j
- SHA256 835e822219a3e2e7a357e6c857d53d618a404444430f393e830ff653dc5e712b
- MD5 c19abe78605b06d8c6e74ed602f1b4ca
- SHA1 e879e596df39226584a30b7f007b1bd2d1b2f7d1
- SHA512 43bfe6c50ab210f92d2a223d140fcadfa824aacf12b8a15e8cbd350d79ec852be2dacc65e4b924fe65e1ae42aa6f3c82b95325fb72eaf920b622fe95c3adb7cd
- SSDEEP 24576:iwXVNMO56rsJ5/6vNtdTaZ+s57xjRaSDMiA2PqCW+v:iwXkM6rsP/IaZx57xjRaUMiA2Pq+v
- TLSH T1D5458D32B941C17EE4664073CAFDAB9D606DA5720B3610C3B3D81A6C6E30AD36F3565B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral1/files/0x00080000000243dd-7.dat family_shodi - Executes dropped EXE 1 IoCs
pid Process 4444 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.usa - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.usa - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1060 wrote to memory of 4444 1060 2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.usaC:\Users\Admin\AppData\Local\Temp\2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.usa2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4444
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.usa
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-03_c19abe78605b06d8c6e74ed602f1b4ca_cobalt-strike_darkgate_elex_kwampirs_nymaim_redline-stealer_rhadamanthys_stop.usa
- Size 1.0MB
- SHA256 08b245685ef9e736d318e366d23e4d1f3234ec6009f6c9d3c52b326fc7ddc845
- MD5 ce90182e4649b98d24f5bab35ffdb77c
- SHA1 7e475d76c28eba63f4c4008faa7b281da392507f
- SHA512 77a19bd48321c3404393d298a80522aaa2ec8de849eb27bf6363f1c46dda3d530f44bd0b13d4834391bb288762f03041f99f9a2d970949e38de94ecdebb42869
- SSDEEP 24576:956rsJ5/6vNtdTaZ+s57xjRaSDMiA2PqCW+:36rsP/IaZx57xjRaUMiA2Pq+
- TLSH T1CF358D317941917EF4A610B3CAFD7B9D202DA6720B3610C7B2D81A6C6E30AD36F3565B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 1.2MB
- SHA256 835e822219a3e2e7a357e6c857d53d618a404444430f393e830ff653dc5e712b
- MD5 c19abe78605b06d8c6e74ed602f1b4ca
- SHA1 e879e596df39226584a30b7f007b1bd2d1b2f7d1
- SHA512 43bfe6c50ab210f92d2a223d140fcadfa824aacf12b8a15e8cbd350d79ec852be2dacc65e4b924fe65e1ae42aa6f3c82b95325fb72eaf920b622fe95c3adb7cd
- SSDEEP 24576:iwXVNMO56rsJ5/6vNtdTaZ+s57xjRaSDMiA2PqCW+v:iwXkM6rsP/IaZx57xjRaUMiA2Pq+v
- TLSH T1D5458D32B941C17EE4664073CAFDAB9D606DA5720B3610C3B3D81A6C6E30AD36F3565B
- MD5 SHA1 SHA512 SSDEEP TLSH