njrat | a1871eb203ab9137191fe77d01f9c34db383e197e22f5651ac0a98389a040674

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_ab0b63f826e6cfbdf525d63f9f3811af_dcrat_elex_glassworm_icedid_luca-stealer_njrat.exe
Size 12.5MB
Sample261111-3eg5xacf47
SHA256 a1871eb203ab9137191fe77d01f9c34db383e197e22f5651ac0a98389a040674
MD5 ab0b63f826e6cfbdf525d63f9f3811af
SHA1 9bed149e0d2cd335a95a9733675d0da61a2c7347
SHA512 dcdb587809042ab0f51a08117ad1aff7b29e6ac1d52cdd74bd624a5dbfd502a1585745f0185b6040fe3d5f9f96a406fc2b464fec2ba2e6d0868ba02cd0ce460c
SSDEEP 393216:dWFkV31DPsZg2KezvSa4CxK4+HsMRDBbYonw:wWV31wLXH4DrRFb3
TLSH
T18CD63386B7840B94D859253A98DB603253E1BCA30732C5CA3FD85B5E2F633EAFD25741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacked defense_evasion discovery execution njrat persistence privilege_escalation pyinstaller trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

Mutex

MyAppMutex_Windows_Explorer

Attributes

ddr
https://05-03-2026.blogspot.com/ads.txt

https://okx2026-project.pages.dev/ads.txt

https://okx2026-project.onrender.com/ads.txt

https://reliable-lily-e3a7a3.netlify.app/ads.txt
reg_key
MyAppMutex_Windows_Explorer
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Custom signature

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c564-21.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1500-27-0x0000000000810000-0x0000000000846000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3812	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
5404	Setup.exe
1500	coreinitx64.exe
3640	explorer.exe
1844	coreinitx64.exe
5744	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe

Loads dropped DLL 11 IoCs

pid	Process
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe
3576	YOMO_FILE EDITOR .exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\coreinitx64.exe\""	coreinitx64.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	coreinitx64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 2328	3640	explorer.exe	98

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	RegAsm.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x002700000001c53f-50.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4276	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	Setup.exe
Token: SeDebugPrivilege	1500	coreinitx64.exe
Token: SeDebugPrivilege	3640	explorer.exe
Token: SeDebugPrivilege	1844	coreinitx64.exe
Token: SeDebugPrivilege	2328	RegAsm.exe
Token: 33	2328	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2328	RegAsm.exe
Token: 33	2328	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2328	RegAsm.exe
Token: 33	2328	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2328	RegAsm.exe
Token: 33	2328	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2328	RegAsm.exe
Token: 33	2328	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2328	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 5404	984	2026-11-10_ab0b63f826e6cfbdf525d63f9f3811af_dcrat_elex_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5404 wrote to memory of 1500	5404	Setup.exe	90
PID 1500 wrote to memory of 3640	1500	coreinitx64.exe	92
PID 984 wrote to memory of 5744	984	2026-11-10_ab0b63f826e6cfbdf525d63f9f3811af_dcrat_elex_glassworm_icedid_luca-stealer_njrat.exe	94
PID 5744 wrote to memory of 3576	5744	YOMO_FILE EDITOR .exe	96
PID 3576 wrote to memory of 4276	3576	YOMO_FILE EDITOR .exe	97
PID 3640 wrote to memory of 2328	3640	explorer.exe	98
PID 3640 wrote to memory of 2328	3640	explorer.exe	98
PID 3640 wrote to memory of 2328	3640	explorer.exe	98
PID 3640 wrote to memory of 2328	3640	explorer.exe	98
PID 3640 wrote to memory of 2328	3640	explorer.exe	98
PID 2328 wrote to memory of 3812	2328	RegAsm.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-11-10_ab0b63f826e6cfbdf525d63f9f3811af_dcrat_elex_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_ab0b63f826e6cfbdf525d63f9f3811af_dcrat_elex_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Enumerates video capture drivers
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2328
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "RegAsm.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3812
- C:\Users\Admin\AppData\Local\Temp\YOMO_FILE EDITOR .exe
  "C:\Users\Admin\AppData\Local\Temp\YOMO_FILE EDITOR .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Users\Admin\AppData\Local\Temp\YOMO_FILE EDITOR .exe
    "C:\Users\Admin\AppData\Local\Temp\YOMO_FILE EDITOR .exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:4276

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 91KB
SHA256 f54c41308b518fd2b5e010990f0de0d39ba4bbb3297df0b1d571b58fb45831b6
MD5 014458e54bcaf9d495a9bd4f233d050e
SHA1 7e84bdb820366cf272cb68a6d9c6eb6f53c46738
SHA512 c9114f8d7caa36ced3d3f98375a1fdbcca8308b0ea72a8fa75bbf6f807c437ff9a9a3a2ce29de42650273ada49a84790891f69b7d1414b5fbd438df9f2e30b26
SSDEEP 1536:zmFhgQhMrWLI2X+Li3xxSXIx/uSbopCbMktSrgpnvf9Tmnp:CFhgQhRLP+LmiIweXSrSvfJy
TLSH
T18493A68372898711D91429B580EF293003E26ED71B33E6C57F4C67ED9E617A3DE81B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YOMO_FILE EDITOR .exe

Path C:\Users\Admin\AppData\Local\Temp\YOMO_FILE EDITOR .exe
Size 12.3MB
SHA256 eea29296da7e62e067c38eea47367ee4a8578b2e1df58cf460de3f8286771082
MD5 0feaf48fce425e527bb3382b5a5c9abb
SHA1 947b6e5dfa911ae677a15c5f6c56dbde676129a4
SHA512 cc9058f11ff916639f4b5f600f6fc5db573c9f2203d8fb933ab1a3c75b4a120c9441fc2c253c4ea73815a95a35938316bf4b940c23e939eff608f7429e0bd2a6
SSDEEP 393216:0WFkV31DPsZg2KezvSa4CxK4+HsMRDBbYonw:dWV31wLXH4DrRFb3
TLSH
T1E5D63385BB9408A8D89B663E6CD59177A3E0F4304761C9DF1BE44A1A2F631EDFD38342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_bz2.pyd
Size 85KB
SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
MD5 b831ff0ab5f28a1f3bae6842896d45ff
SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
TLSH
T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_ctypes.pyd
Size 139KB
SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
MD5 208e7dd066f23080da03b4ebd20fbc43
SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
TLSH
T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_hashlib.pyd
Size 67KB
SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
MD5 4f7f664e8558a6cfc93ede2ae9d6974a
SHA1 0b5ed2b9c68120d5912f12c1d6038afe517547a1
SHA512 89cc41406f4b3da7ea46e15e12f86135ffe8c3fa2d906c8aa370402cfa4bd67fa00e2901e33e3e44daed075ddb9ac35c4dfd3181c44544d17c97522363227b85
SSDEEP 1536:aL0SOWZsPqJWvnKt6RfoISDI1ycA89tfIYke:ULYyJWvnKt6NoISDIYM
TLSH
T1A2636B4AA6984062DA2382B4C8E34F43FA74F652271197DF6779C18D2F233C3537A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_lzma.pyd
Size 157KB
SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
MD5 d412fca808a8dd9178ccf8bd9517859b
SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
TLSH
T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_socket.pyd
Size 85KB
SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
MD5 b8732b29606a0d93be25bcd924b50239
SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
TLSH
T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_zstd.pyd
Size 491KB
SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
MD5 225e0462bf8337155e78b36e3cf9fa79
SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
TLSH
T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\base_library.zip
Size 1.3MB
SHA256 d7d4267682d35361a1ac41d56965752963b5221a36366fda768789e14d3b7370
MD5 8621d0ea61698228828e70addede506b
SHA1 cb83999046a6cf6103d02f9e2f0d3dc62a8db4d9
SHA512 6b1faa407ff781854767cab63734edb7e5ce5fe3ba98b71c10a738d34f4b2121fdfe7eaffd12d36620e2a35ba2bd5bf5627130cf7440941511034b1f7ed6cc6f
SSDEEP 24576:BuUFrslbqLoA37lQeOdP2m2df1d+uoRpA3:BuUFJx/Nd+uoR4
TLSH
T15E552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\python314.dll
Size 6.4MB
SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
MD5 23b7bec4bb8cf109503029b50f5eadd5
SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
TLSH
T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\ucrtbase.dll
Size 992KB
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
SSDEEP 24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
TLSH
T12425AE68F66C0AA9D07BE17CC91B550FE9B23406477096DB03E64BB93E2B7D5163B320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreinitx64.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe
Size 195KB
SHA256 ac2522ebf4b0849da9d911cbec3b55e83c8ab08bb4ebd37b0d8f412fb01d9042
MD5 bbf99c5e602cfeb26dfeaad791418bca
SHA1 ef66d108e34b29c6cdfbc7c7fbe448aa315a4253
SHA512 c043013ee3b10b5ddf0e81d251b03d5e1d0c5148385314a613e6ec21a0a4af7777f58b42f0ec826d71b87ac06e35457f43f7be3a5eb4109a111096fe1046400d
SSDEEP 3072:a8KgaJKKI8h87pLLZ70N1FCbzSoIFLm+TKK1IGqaFhKsyDUIJ5ul/O6HDwbWYHt:RoI8hCfdtbzl+m+MrjJ5ulW6HMbf
TLSH
T17914844376884311D56468B580FF293113E2AED71B33EAD93F4C679E1E117A3DE82B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
Size 204KB
SHA256 faaa77094e443093d4cca3f8e8a1e11a8e3e6db0fb73bf8bf6337078016b9a81
MD5 e5008d04ee79fa66368209ac57369f56
SHA1 8b4ed72119501de5781b095abb273b3ac49dda63
SHA512 462e795d6ba516c5bd61c219f8c60cdf12b4009a777a2d88e95d6a4678f5725470dd7e3d273da464e6c1774e0b51513bb0d4c54e1cb95db431c4bd88cac05efc
SSDEEP 3072:Dwo+e7I8TkDq3vY3bUiyL3kCKhcZHONiSsAzWddLcbpt7Mbmvs:D3+zYS4iI3+cZuNiSsEiwbLMbm
TLSH
T189246C47B2889755E95865B5C0FB6C3143E2AEC72B33E7D23F40729D1D813A39E82E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-101-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/984-0-0x00007FFA132BF000-0x00007FFA132C0000-memory.dmp

Download

memory/984-2-0x00000000008D0000-0x000000000154C000-memory.dmp

Download

memory/984-1-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/984-3-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/984-4-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/984-7-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/984-8-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/984-12-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-27-0x0000000000810000-0x0000000000846000-memory.dmp

Download

memory/1500-48-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-47-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-29-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-37-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-28-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-31-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/1500-30-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/2328-1065-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2328-1066-0x00000000058A0000-0x000000000593C000-memory.dmp

Download

memory/2328-1067-0x0000000006770000-0x00000000067D6000-memory.dmp

Download

memory/3640-45-0x0000000000E70000-0x0000000000EAA000-memory.dmp

Download

memory/5404-14-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/5404-32-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/5404-17-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/5404-16-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/5404-15-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp

Download

memory/5404-13-0x00000000003D0000-0x00000000003EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads