875adf1ddd2a4d8456cd6a5ea11038b0e316a9613c0ceccbe45ccb6f548800de

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.exe
Size 18.0MB
Sample261113-da42faez5v
SHA256 875adf1ddd2a4d8456cd6a5ea11038b0e316a9613c0ceccbe45ccb6f548800de
MD5 55c6436c2a2bfcd18e0bf04ab5489329
SHA1 c485ab40bae368875bf5f178854e5107878137c1
SHA512 65151f998689b2e98cb0b28c07a1322f83902c32c6994b293ca8eed8ef7208c260c4327ffde09bccba38aa8c6429a55d4f111d0e971ed304cd2ddc055d825dd2
SSDEEP 393216:OlPCGl0P965GD4xe7EcVGV3wAzHA1BFyS7sCzC:E7gUc7E7V3wA7A1uSoH
TLSH
T10417131BA2EE60E9E4A6E1398913D50BC7737C700131C69F92A87A5D9F732920D3F356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1840 created 4700	1840	elevation_service.exe	81

Custom signature

Detects Windows executables referencing non-Windows User-Agents 10 IoCs

resource	yara_rule
behavioral2/memory/6088-300-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-314-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-315-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-316-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-331-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-370-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-437-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-438-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-447-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6088-672-0x0000024C100F0000-0x0000024C13361000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4916	attrib.exe
4220	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
1444	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp
3440	1QWs0.exe
1584	1QWs0.exe
3872	1QWs0.exe
4160	1QWs0.exe

Loads dropped DLL 4 IoCs

pid	Process
3440	1QWs0.exe
1584	1QWs0.exe
3872	1QWs0.exe
4160	1QWs0.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5404	icacls.exe
5948	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2676	cmd.exe
2768	cmd.exe
5784	cmd.exe
5484	cmd.exe
960	cmd.exe
4184	cmd.exe
696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4788-0-0x00000000001F0000-0x00000000002D4000-memory.dmp	innosetup
behavioral2/memory/4788-24-0x00000000001F0000-0x00000000002D4000-memory.dmp	innosetup

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	58	Go-http-client/1.1
HTTP User-Agent header	203	Go-http-client/1.1
HTTP User-Agent header	298	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4056	taskkill.exe
1744	taskkill.exe
5160	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3440	1QWs0.exe
3440	1QWs0.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1584	1QWs0.exe
1584	1QWs0.exe
6088	waitfor.exe
6088	waitfor.exe
6088	waitfor.exe
6088	waitfor.exe
3872	1QWs0.exe
3872	1QWs0.exe
4160	1QWs0.exe
4160	1QWs0.exe

Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3440	1QWs0.exe
1840	elevation_service.exe
1840	elevation_service.exe
1584	1QWs0.exe
3872	1QWs0.exe
4160	1QWs0.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe
Token: SeDebugPrivilege	5160	taskkill.exe
Token: SeDebugPrivilege	3440	1QWs0.exe
Token: SeShutdownPrivilege	1840	elevation_service.exe
Token: SeShutdownPrivilege	6088	waitfor.exe
Token: SeDebugPrivilege	6088	waitfor.exe
Token: SeDebugPrivilege	6088	waitfor.exe
Token: SeBackupPrivilege	5728	vssvc.exe
Token: SeRestorePrivilege	5728	vssvc.exe
Token: SeAuditPrivilege	5728	vssvc.exe
Token: SeDebugPrivilege	1584	1QWs0.exe
Token: SeDebugPrivilege	4488	whoami.exe
Token: SeDebugPrivilege	3872	1QWs0.exe
Token: SeDebugPrivilege	4160	1QWs0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6088	waitfor.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1444	4788	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.exe	89
PID 1444 wrote to memory of 4056	1444	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp	90
PID 1444 wrote to memory of 1744	1444	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp	93
PID 1444 wrote to memory of 5160	1444	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp	95
PID 1444 wrote to memory of 3440	1444	2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp	97
PID 1840 wrote to memory of 2676	1840	elevation_service.exe	100
PID 2676 wrote to memory of 6088	2676	cmd.exe	102
PID 1840 wrote to memory of 2768	1840	elevation_service.exe	103
PID 6088 wrote to memory of 2912	6088	waitfor.exe	105
PID 2768 wrote to memory of 5404	2768	cmd.exe	106
PID 1840 wrote to memory of 5784	1840	elevation_service.exe	107
PID 5784 wrote to memory of 5948	5784	cmd.exe	109
PID 1840 wrote to memory of 4220	1840	elevation_service.exe	110
PID 1840 wrote to memory of 4916	1840	elevation_service.exe	112
PID 1840 wrote to memory of 5792	1840	elevation_service.exe	114
PID 6088 wrote to memory of 2448	6088	waitfor.exe	116
PID 5484 wrote to memory of 1584	5484	cmd.exe	123
PID 6088 wrote to memory of 960	6088	waitfor.exe	124
PID 960 wrote to memory of 3668	960	cmd.exe	125
PID 960 wrote to memory of 4488	960	cmd.exe	126
PID 4184 wrote to memory of 3872	4184	cmd.exe	129
PID 696 wrote to memory of 4160	696	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4916	attrib.exe
4220	attrib.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4700
- C:\Users\Admin\AppData\Local\Temp\2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\is-AJVHJ.tmp\2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-AJVHJ.tmp\2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp" /SL5="$4009E,17834917,867840,C:\Users\Admin\AppData\Local\Temp\2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM 1QWs0.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4056
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM 1QWs0.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM 1QWs0.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5160
  - - C:\Drivers\f8FiO\1QWs0.exe
      "C:\Drivers\f8FiO\1QWs0.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:2912
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:2448
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3668
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:5404
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:5948
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4220
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4916
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn CDPoAQFBzOXYUrALwXipCiTh /tr "cmd /c cd /d \"C:\Drivers\f8FiO\" && start \"\" \"C:\Drivers\f8FiO\1QWs0.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5792

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\f8FiO" && start "" "C:\Drivers\f8FiO\1QWs0.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Drivers\f8FiO\1QWs0.exe
  "C:\Drivers\f8FiO\1QWs0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1584

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\f8FiO" && start "" "C:\Drivers\f8FiO\1QWs0.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Drivers\f8FiO\1QWs0.exe
  "C:\Drivers\f8FiO\1QWs0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3872

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\f8FiO" && start "" "C:\Drivers\f8FiO\1QWs0.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:696
- C:\Drivers\f8FiO\1QWs0.exe
  "C:\Drivers\f8FiO\1QWs0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4160

C:\Windows\system32\schtasks.exe
schtasks /query /tn CDPoAQFBzOXYUrALwXipCiTh
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BIbWxGDm6C.rBZH

Path C:\Drivers\aoaBoyTfyU89\BIbWxGDm6C.rBZH
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 16KB
SHA256 7dcfbf5422196e0775aab90e31914e7fa618bf3a73bed07993e183bfe897043d
MD5 ac12352959f36711367b4b2b62e8014c
SHA1 ea05732e04a56f1937e58ed934dac2e1eb9bd760
SHA512 bfea777e20c914b50a06f86214b9c79498b249f98a04badfb9837fe2030922e05cf7dc233bff6432e9cfcd94785f5dafbbeaee47d4bf17a4940bd3671ebb959f
SSDEEP 384:vXDxvRomMeUMoiV5WF4Za1CIYDXAd7na7EEE8Jc7sPE2lpZLGO:/DDomMrM/ul1SwRaEElCUYO
TLSH
T11272D17762A8F0F8EC6345762B27D529F6C613BB3144367E25100A44CDDD3382DDE2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 27KB
SHA256 f4c1eb42b520de44f9460ea3bdcd984cd2fbc70ced0485d10cab15fb1a4a2ace
MD5 b0944fd634b3e78b97509dfb4d4aba2f
SHA1 0b91c055b1cfbb6a9d38e17cb8e9e8674f89b605
SHA512 5ed0964a7ef02ad27b807f4a461bfff88ea2fe16035fc4840e95a5c19a1938b6444eb111df0241fcd0f54ed1f14037bfaf907c193132797b25b3be69cb16cd32
SSDEEP 768:/DDomMrM/ul1SwRaEElCUYB1boQl5ayfRTVUn:forg/q1SrEEl/YRUyHA
TLSH
T140C2E1376376F0F8AD5741572B2AC629F6C513FB3304397822A15A8DEE8E3583CDA650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 29KB
SHA256 14046609596df5833dcd3c06ef3e54aaa1dda2484a7ed1d5cc2a3993cd84f621
MD5 b81df0506129ffaf52bf5cad97ba5c53
SHA1 cb0ec63ab7be7f842371585db66db324495731d3
SHA512 02fe87d788f1413d009befb1245a7a7bc661ba86988e654ffe0f942b40df9e57a81e51c0dbcd85f698d783a169c4455c5683ce0d724859abb24350841bbfd631
SSDEEP 768:/DDomMrM/ul1SwRaEElCUYB1boQl5ayfRTVUJ3xIgE:forg/q1SrEEl/YRUyHEE
TLSH
T160D2F1376366F0F5AE5351472B2EC625F6C413FB3300397823A65A89EE8D3282CEA554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 33KB
SHA256 65a3de0a0bc65f6705a348fe05e5c75c6e4eb17a2dd28c92505ee32798d96734
MD5 fb4413a7e1f188d8cfaeccbb72e67e50
SHA1 0b4c50b47e6e1055d177b44910f61dba38be2e22
SHA512 b1a4878015490b3d3911eb17ab1b6d90853a409d46b72113e04b83b348f09dbae792fe73e051fd3fc102ffad53da1384bbaf9ec930e54c87ea36fd9f55679c20
SSDEEP 768:/DDomMrM/ul1SwRaEElCUYB1boQl5ayfRTVUJ3xIgziMi:forg/q1SrEEl/YRUyHELi
TLSH
T1D2F2F13352A6F0E4AE63A5172F2DC325F6C427F7330439B822665988BE9D7285CDB640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 40KB
SHA256 839787ef14c617e8f0baf07d4598c1b751a59d41912c8d801baa9f7ab3beff92
MD5 862368234d25cdc9eda5ca01640e228e
SHA1 f4122dc5877b98d936a2787d6a8c0bfaadfdfe4e
SHA512 83fa614ec7975285917bcd31a216e50081b23e0eec142e3c24404efbf62626bb9f6a3fa0c34fe54606f3a32befa07455e0e6d2431f3880b5288a6dc5792ef596
SSDEEP 768:/DDomMrM/ul1SwRaEElCUYB1boQl5ayfRTVUJ3xIgziMod8RNHV8eTt:forg/q1SrEEl/YRUyHELouRNHV8eZ
TLSH
T16E13F22753A7B0E4AE335A162B3DD3A9F2C113F2330075B92265198D7DA83645CDA280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 42KB
SHA256 c364bb248b918bd607daa3332e3778f535e10fa5c8a59627e4a78af7f50cd919
MD5 81bd29f81c2491c58c9b316646941d3c
SHA1 e2922056c401195f02c25821abb0c969080ec8e1
SHA512 f58fe4276236c104d59d1cf2488db763756420fbf90e0315539d0e14e65e28ce5e21aad59f693a713654ac23a01fdb5cfa4eb8870fb68a91f12bff6ae291138a
SSDEEP 768:/DDomMrM/ul1SwRaEElCUYB1boQl5ayfRTVUJ3xIgziMod8RNHV8eTKfuYBI:forg/q1SrEEl/YRUyHELouRNHV8emfdI
TLSH
T12013F2276397B0F4EE335B562E79D7A9F1C143F2330075BD21A4198D7DA83645CDA284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 824ca601ca56eeea758202b2114ad62ef45c4f7f1667d7bd8b389ab4409914ee
MD5 bd49917578df40e44789a2aeb2303255
SHA1 c58bd12d0b148130e66c53acb3ef2e0b3336c242
SHA512 67fa0d4ed6c4e9f46cfed33f1f7be82ab9823fea2d134fd9e04696280ba3dbb6aba3ac609d818f99c6ecdcd888b38999154ddf39d9aeaa3cc8ee94e01657ce53
TLSH
T16D416D26C1D0A2B8D4F04ACDBF2FE50861E22DF3130A386E730A9F10C4D13270A49828
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 54KB
SHA256 23af1cd03853587d38f66c85f5a81e0f1a45040cacc5a27b77adbdbc2df684a9
MD5 6dd78feff4827d90fd945261bf1bbcec
SHA1 e3a171966d39be97606e072f9ed74342fabb608e
SHA512 ff28efc8467c1cdf4915f7750bc69c298518f447fd4767fae3184dc5690bb5bfafeaf8688580e7a6167147e9c72de44c5a82725acb8a89535f751fb06e68b5ed
SSDEEP 1536:forg/q1SrEEl/YRUyHELouRNHV8emfdHhOAIGGTep:fW1S5lbyHhkV8NBhPcQ
TLSH
T1EE43012B63ABF0E86D335B991A7DCA19F2C057E2320465B9112429CD7D9AB389CE5344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 2f0f20299c608f0733c20fe94bd967f2bed26ae21c6e274b20119fdc9ae1d284
MD5 a666a10368dc1ba074f68bcd0ca10555
SHA1 268915d044869048d01b435c24dc5b89409b6f58
SHA512 c0e863307ce473bf2c39da1ab5218840a2fa89de71ced7fb0acd3de385b68514697125a3fa2c4da9d024c30227a44afe38ba93ed1468fb4bd6d21cf285373515
TLSH
T1F5514C1AE1A0A2B4E0F14BD97F6BDA4476D56CF70309393EB60A5B00C4E032B0B49458
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 13edd3243f9ba2696fa27a2162ac088d809b9598638b51da50cdec96d1cc2476
MD5 4efa33032286393fb9b6da685b717cb4
SHA1 4b678d163529d584132f904c7b4b4a99c3d33d9a
SHA512 02807b6eea65ef2fb07e4616d550fccb5950af2679679092d380e67aa68cf8fd42b8ad8fcf8641b4500e09394fb39064fbc04f810a1f823d0ae8a1d3a7722fff
TLSH
T138716DB6B560F6E4F4A056D4679AD25462CA79F7530D3D2D731D4F04C8D226A078883C
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 83KB
SHA256 98925f82bcd46cedca78b90c08763c9abdeec8593163daa6fbeb54d89e315e60
MD5 ac77f7f5f72297e40fc3cb5dd59b3ecf
SHA1 43a2b6ffb4a558ba7bd08a5f4b2d68aa268c1b2b
SHA512 65d093dc27a38094e380226931213939453b97349afce4018f849d8b367c61f68ee86ba106537a1e6b3b639559ad0328a0f4b40ab982e37c35d18585f78112ee
SSDEEP 1536:forg/q1SrEEl/YRUyHELouRNHV8emfdHhOAIGGTeKcmPFqdjec6VtJMfEmQ4qMV:fW1S5lbyHhkV8NBhPcqmdq5LLQo
TLSH
T15483022733E7B0D86E23CE951BB9DD98F2C91BE6314016B915A4158C3E9BB348CE3349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 121KB
SHA256 dee8a78423ca313481a4dd73f5e390f220fe0f5b2353ce1fabdd18b5034e98fb
MD5 45e1db853bbdfc352c2ad95b1f52e4ac
SHA1 656375c1f004b3d5ba56abbfc34642b175be621b
SHA512 afec223c901b7fef425d0ba34cc989736d6cae52d51ee3488e0894c987b66ee0479179f4bffbccf9cf9beb26b62fe8c194ce9bf25b5e6ed3b581a8e416dbe35e
SSDEEP 3072:fW1S5lbyHhkV8NBhPcqmdq5LLQNPqhHNp/+:6S5hyHhE8NDcPdq5LLQNCzE
TLSH
T13FC31227239A75ECADB19ACA17BDC7E4F7C50AD6314823F4905525CD3EAFB3148D2604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 15KB
SHA256 03eed3aa4a05475992e0105f6a90bdc1960c8ec0e7e4c539e3267c2e1995073d
MD5 f209c27817e54ba466b8421149b7d686
SHA1 faac4b11f19ee5bb95ec4a2207ae7328676ea4ac
SHA512 1e2d0144ed5cdff3816dfddc46632531d7e1fa5c13477f24fdaf797f718bbf5e45f20a16c2c6e0bda652575d70185ec11c437c0713a6dd9a16851ad9f27e146f
SSDEEP 384:vXDxvRomMeUMoiV5WF4Za1CIYDXAd7na7EEE8Jc7sPS62J:/DDomMrM/ul1SwRaEElC9J
TLSH
T11C72C0BB61A8F5F8A86305663B27D56AF2C653BB3144373D25204648CDDE3382DDE294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 16KB
SHA256 1b0730678c7d895e8393663d62b8688dabe85ed2ca47cd1ae4b653061e7c591c
MD5 702f4cbd12ba2a81dfd293bd97ffd200
SHA1 250c2009dff5da135a0f77c6e53980b2b4314198
SHA512 a4e0e68e6dc0d280d4097572dfddf66e2bf03b1bb33559e41cbe94f99d4c4fa2e7096fa32b606d9793b3616aac48a95b3706d8a86ce830262da5a55b9f35c1d5
SSDEEP 384:vXDxvRomMeUMoiV5WF4Za1CIYDXAd7na7EEE8Jc7sPS62eZLGO:/DDomMrM/ul1SwRaEElC9HO
TLSH
T1F072D17762A8F0F8EC6345762B27D529F6C613BB3144367E25100A44CDDD3382DDE2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 27KB
SHA256 b3768c31f5c3c502256f8fc3402853e27d7174e4980bb32452c3a3398febda3f
MD5 8ec9d0a619a9a326f4af40e77d8b6b68
SHA1 8981e7483ee09f1ea9b146768e418ff55d1b10fe
SHA512 4e26e9b5d90c801e24a632c0c9d1a3f605951733d6e4ebff1ff2712fdc55003625baa4fd128f18cce325e252be6e5b10e150794e1f65f52d4f9647905f1e3ca1
SSDEEP 768:/DDomMrM/ul1SwRaEElC9HB1boQl5ayfRfv2n:forg/q1SrEEloHRUyNu
TLSH
T152C2E1376376F0F8AD5741572B2AC629F6C513FB3304397822A15A8DEE8E3583CDA650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 28KB
SHA256 13540b0a23b08753dfcb3697c27be0c12112a470e3f0357b775e564876421bf2
MD5 a084ba5decb39f7ce8cbc84cf7374039
SHA1 5ae0f4af9b960a8f34044339282e37059cf62114
SHA512 4719454ac0c91de08d4cde6fae7563967ba7728c4a228594da2448235bcd1a50eef5cf0dfa889b5528eb3927d8ceec3e5853cd03d45f727013a6b82fccb32d34
SSDEEP 768:/DDomMrM/ul1SwRaEElC9HB1boQl5ayfRfv2J3r:forg/q1SrEEloHRUyNm
TLSH
T1C6D2E1376275F0F8AD9751172B2AC629F6C413FB3304397823A15989EECE3683CDA650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 33KB
SHA256 ef302f8d1730508d3a5238cf4a265959ac8136d3450f23c7503330a2a4ee8335
MD5 c1859db8fc1cca31d2d2445df4688ac1
SHA1 4fe5632b7e59c1b9b392c2167fda0572a703746b
SHA512 16f89f76b1aa304456ac708717e876f88cb9f7ad5ede2ceb5df1c3ac06a5586f4ad6ed70d7c71f22d14128bcbe17e626c6482dd5884ebfb732e20755ac09f167
SSDEEP 768:/DDomMrM/ul1SwRaEElC9HB1boQl5ayfRfv2J3xIgziMi:forg/q1SrEEloHRUyN6Li
TLSH
T19FF2F13352A6F0E4AE63A5172F2DC325F6C427F7330439B822665988BE9D7285CDB640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 1KB
SHA256 ba1093cc098fe5846ebe46c2998d15c480b266443fe9af13a953a9930f97cb54
MD5 b851b5e451e24aa80d39792ecd864aa5
SHA1 ed2b84a4301e8780078f6d92563d02bcc139cac5
SHA512 32378d6eafc58e599ec541982bf67253114620e3fc3255c8a0c4297f78a71ace4f779c6c3ddbf5dfafe21c7f64fc590ee705bebddffa4bc3cc65a6e86e406a77
TLSH
T10821D786C0E5E7B09AE343DEA73FF61439F50EAB13083C9C81158F00A4DD6B31909E98
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 40KB
SHA256 3e6c6f003a72ad0d32dbbb27e2d6c842292c1526c5c0b6caceccc3370fdcea1f
MD5 19607cb44a64e5a89e938a1d0246192f
SHA1 c85485c91a26a8247858706da40e3f095b9635fe
SHA512 816ae94bdb28d7e9f0a33563920eea5c3554bd823a45edcdcc17e7dc441e76396502875ed87d508049eeca142d6b5902d1b2c5360a166690662fbcf25ee2a5ee
SSDEEP 768:/DDomMrM/ul1SwRaEElC9HB1boQl5ayfRfv2J3xIgziMod8RNHV8eTt:forg/q1SrEEloHRUyN6LouRNHV8eZ
TLSH
T15C13F22753A7B0E4AE335A162B3DD3A9F2C113F2330075B92265198D7DA83645CDA280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 42KB
SHA256 4889826e4a9d94e0b8d41869fc9e2bbfd61787a5076c61980ab3e58d2c8769a5
MD5 1908de24ade89dc8e445c21945966553
SHA1 8ad638b2f607e7ab9466ae0f8a328d7303873d5f
SHA512 78d2475fe58be6eb7f45d5a64cd34c61769763ed99340c96aab9850ca32e58a1038b10f0353e561f27ad124437064e0b909c9a1b5ae08957075054e57fc7d7fa
SSDEEP 768:/DDomMrM/ul1SwRaEElC9HB1boQl5ayfRfv2J3xIgziMod8RNHV8eTKfuYBI:forg/q1SrEEloHRUyN6LouRNHV8emfdI
TLSH
T1BC13F2276397B0F4EE335B562E79D7A9F1C143F2330075BD21A4198D7DA83645CDA284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 1KB
SHA256 d3fa1011cea5096ac0829b1826fcf7347b2d8ec7db4d7372ed729b7d8fc38bed
MD5 d27702c746fe39874b504f9d2465774f
SHA1 dd5a66fdceddd8600cd459727f1b75d89109b83a
SHA512 8429074b74d4d0b4cfd432464a84b984b2d074e4fe2c188f20743ec4f6f3af5979b450b86111b879df5dc620c3437e26221456e6be808fc2da0e7d8c99ad976d
TLSH
T188415B26C4D0B2B4D8E249DD2B3FF508A5EA0EFB430A3C5CB3019F1094D47570A48C6C
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 54KB
SHA256 850d080512970832732af8e61fa3e4fe5be53da69df991f46202c12d58a83fc1
MD5 616579f8cb89aa1bc0191647f931a7aa
SHA1 ce393a9eae7f199f770e04889dd2c7d6c5412ac2
SHA512 d730d2147e90bc5314f5c71c8617dd3cda51df167febeb6659a38bdcc8d7fc7508599b7f23cb11604a4af1079191763729187235bde9fa147c44949d40565d23
SSDEEP 1536:forg/q1SrEEloHRUyN6LouRNHV8emfdHhOAIGGTY:fW1S5lRyNHkV8NBhPcY
TLSH
T16F43012B23A7F0E4AD335F951B7DDA59F2C017E2320475B9122429CD7D9AB389CE5384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 4aee2c800c0e76ee3e1abbefa049922ec776fa7b4f90b986a25f5ada3826f313
MD5 16ec73e9efa7147251899a475f6f7642
SHA1 4ec66715423b4f557e6cff1e4d2e42acff3c159b
SHA512 4d1c600deadd94b3548e5eb853a67d4460817580880e5b96f98647a53a52df477898ff8bd273bfd6125705083a927ec0a190be77d50e0b5d730f35a35de5c300
TLSH
T1C6615C67A570B2E4E4A046C56BABD664A2D56CF7430D3E2E721D8B04C8D13791B8893C
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 4KB
SHA256 eefdf71184901d1f7fcc4f76a03afaece698d52788452299b5cc035912d75a15
MD5 066ef3cc113c66183e074da074295925
SHA1 2f27f804d4b280081724d4db7b99bab2c6e960e8
SHA512 cbe099977c52534bd5ef8ba8cb855b0f458844a4ed5fa97ecda9068210dacc44e4a8542bea0fa1f3dc580c2aee051038d9c7c7281eed24d2f4963d835f42e436
SSDEEP 96:Qc1ECDeSa8NRIDCbPJlV0azd2Irs/e/s/30dXeiBUiuHwCGj3EDS9tu6bN8QZLm+:Qc1tDU8qCbRomMeUMhWiuHwBbN8gKba
TLSH
T181917DBBA160F2D8F09082E4A75ED658B2C968F743093D2D722A0F08D8D52691A8D938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 83KB
SHA256 64da1aba076e428a2ee68f0f59f9850c37b576e262bd6f79c3529d1727da1bf1
MD5 5d3290d9aa5743049d699b1c9d264e11
SHA1 48a8e748340b6a9e1b1c307cf18ae8386746d07b
SHA512 7de8211af7c2661fa43ad146d830ad34e942ed9d3d34aaad813d0bd8ff6bf681ae4c677481bfeeaffd6a2c5bcaf1228bec63ece46b11d1550a104598b507cd80
SSDEEP 1536:forg/q1SrEEloHRUyN6LouRNHV8emfdHhOAIGGTeKcmPFqdjec6VtJMfEmQ4qMG:fW1S5lRyNHkV8NBhPcqmdq5LLQt
TLSH
T1F383022733A7B0D86E23CE951BB9DD98F2CA17E6314017B915A4158C3E9BB349CE3349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 121KB
SHA256 20d063022398d1cb8ba307756c219cf9db4a9851dad6dd434b0df61725a676ac
MD5 cf8cd30f6bad225590c688a5aa7c12c2
SHA1 4197edc183bef2ff413f256b4794c23e1708c751
SHA512 7f5156e640e1b0656d5285c4d902d6e2f39320ee75c3e2ffe7ecdd30d87974a590a0ef8319de077e8cb18058ff3fa0086a2596f573e49c3a40c9b15b44a8536b
SSDEEP 3072:fW1S5lRyNHkV8NBhPcqmdq5LLQNPqhHNp/+:6S5HyNHE8NDcPdq5LLQNCzE
TLSH
T1E5C31227239A75ECADB19ACA17BDC7E4F7C50AD6314823F4905525CD3EAFB3148D2604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1QWs0.exe

Path C:\Drivers\f8FiO\1QWs0.exe
Size 2.7MB
SHA256 90d6f9bb2cc69b86da3df8d350af799265a5097716c719aee09749f4ca5305eb
MD5 de29271f9a5c0e2906fedb8b8aaeb4af
SHA1 840860e20ad48c6f0a1fedcb29dacf398e4de471
SHA512 2ee0f9d5b8b063586eab4ebeb3f10069ae117b36fc27bbb742412523831e68b2ed4ccd376b0acf1a854ddaae21639583e068ea3994b3441a880c63de32a3480d
SSDEEP 49152:CXzdRy1sC0lTfSPK1Z6KQLHtYvRGy/IQa2v31fivBIZui:3ojPGygq316pI0i
TLSH
T10FD59D5F62BD20D4D5A6E179C803991FD7B17C700230C39FA1646B9A6FB32634E2B35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4rzu0.1CZK

Path C:\Drivers\f8FiO\4rzu0.1CZK
Size 4.3MB
SHA256 20f1c26bac9aba438bcbba75d1a4383500c60d1e0bdacf90872f2ab114eafded
MD5 d9d958b511869b99d94e43ed83c89758
SHA1 ebb50e2f80f7df11c1141560bb42d2b684d94aec
SHA512 cf2b4a4a060f994db7d0803c68a04f4c251346a812ac34bda0feadd06a68a7e2d3c40d268a976e3e20ba5156ee45e5c47ba43a08ae0e9455dbfd085992663c14
SSDEEP 49152:kveJmNR8098R+g8utdwwcfHmAGg4Y4gy1DDMI+ksLSQBpSGodhYABtA7mVm8cFkM:NmNy09ngywKp4Y42L5Bp7odP6Sek7/o
TLSH
T1B726BF313241AA14E06F431AE1B81E0CD17D6A4DA7779B9C9F23BEF66D92701EE7418C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-AJVHJ.tmp\2026-11-12_55c6436c2a2bfcd18e0bf04ab5489329_darkgate_elex_gcleaner_icedid_luca-stealer_njrat_stealc.tmp
Size 3.4MB
SHA256 c6002773db287a66951d567fae20b57d79ae9d67dba918cfd1d72a433730ac7d
MD5 8e3571e28715886fbd964a3d3186eb12
SHA1 c1352b43a6b97ae6247deb8aa99280b8631dd500
SHA512 a2ce07d808133e4d603ea5777664dd9e3cdd9971627b9be85930d237b032c7e521d02d30eb213ffb9f6cd61c76d7ecb555c198dcff52174716e5913485be9fda
SSDEEP 49152:zWwGHAkqMu7ot6SCiGoghuXs7+KXrmeSVrJuh52gu8v333TN:z9GdkJuXbeSVQdu8333T
TLSH
T1F3F55D23F34D653ED05B3E3D6A3792A0987B7A602D128C576BEC3A8C4F355801E2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LGI.dat

Path C:\Users\Public\Pictures\Runtime\LGI.dat
Size 32B
SHA256 f5f5d4d31ecd932b5f117d3a47b36ae8834b6b33f6b6f5282ad5dfad054cac63
MD5 9f47eff4e5248fe44844e27378aecb45
SHA1 aa9e57e150c2c93115d5460386d38151f58a7a0e
SHA512 381e578d073fce408ca81eed133ec1de089fe1548bf3f438a2404bff031cd016a7ea0c2082b8cbef558ff71e5643c68ca654990885939ccced4cc5049f3ad125
MD5 SHA1 SHA512

Submit Download

F0B2CB9C11CFD091DCC143A9C3B857B3

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3
Size 657B
SHA256 3417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65
MD5 2edae4397f9c8f37d1709f2617513a8e
SHA1 c3197c3924e654af1bc4ab20957ae2c30e13026a
SHA512 1c0fcf47794efb56b0d583eeb9ce41091443b9caa40e03a6b86de30693b1c9d429973cef30882dde36f03974345310777c6dbf2056fb05492ff99aabe5974321
TLSH
T1DA019985C738A0579FF68381A2C380ABBD7B05DC894F261813ACEDA2618BB909F4245C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1444-23-0x0000000000550000-0x00000000008C7000-memory.dmp

Download

memory/1444-6-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/1584-512-0x00000201F8BB0000-0x00000201F8DDB000-memory.dmp

Download

memory/1840-173-0x0000021E0D7B0000-0x0000021E0D89B000-memory.dmp

Download

memory/1840-369-0x0000021E0D7B0000-0x0000021E0D89B000-memory.dmp

Download

memory/1840-227-0x0000021E0D7B0000-0x0000021E0D89B000-memory.dmp

Download

memory/1840-171-0x0000021E0D6C0000-0x0000021E0D7A9000-memory.dmp

Download

memory/1840-277-0x0000021E0D7B0000-0x0000021E0D89B000-memory.dmp

Download

memory/1840-198-0x0000021E0D7B0000-0x0000021E0D89B000-memory.dmp

Download

memory/3440-26-0x0000022F02A50000-0x0000022F02C7B000-memory.dmp

Download

memory/3872-743-0x0000020D5A120000-0x0000020D5A34B000-memory.dmp

Download

memory/4160-972-0x000002032D5C0000-0x000002032D7EB000-memory.dmp

Download

memory/4788-0-0x00000000001F0000-0x00000000002D4000-memory.dmp

Download

memory/4788-24-0x00000000001F0000-0x00000000002D4000-memory.dmp

Download

memory/6088-314-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-447-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-438-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-672-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-437-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-370-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-331-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-316-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-315-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-300-0x0000024C100F0000-0x0000024C13361000-memory.dmp

Download

memory/6088-289-0x0000024C0EEE0000-0x0000024C100E8000-memory.dmp

Download