Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2025, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe
Resource
win11-20250502-en
General
-
Target
2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe
-
Size
1.4MB
-
MD5
c634a26757ae56a86172dc49678e7f0f
-
SHA1
3ea6440d26552f03f83c172caf32ae9d6d818bba
-
SHA256
36d4aea6de048d6a8ed38f71e3094f754b1a43d196af78f0674c910168e844b6
-
SHA512
256c753f2522ecd18fc8fd0f4ec08333068659c97b0e53a0a31a6641077f6239c1f449a137fb5122d453e5ae9ebc9acbbe0c736c993aabecef00dbd8cb382b02
-
SSDEEP
24576:yw8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+Lj:iKjKWQc2b1FVgbjrjxPe1pbPSQm1FloS
Malware Config
Extracted
phorphiex
http://185.156.72.39/
http://45.141.233.6/
TW3wpRJmZgC5WifuY468JBUCF3TEkzBT5H
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MF6iVGLmErYP9y4B9SwtzarDoy3ETSzYrh
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0x46e5cc402BC848ceC9f4d65c9B48aE7D7A24821B
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1B8FF5WwJXNnjkVzxgPkAznVZ8uKb3Watx
ltc1qyfzdpxky7q2grz4zmqv5x0t0uwfuznl5u43c93
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3GcQJkfHq7NWgBhhNKjz7uSfM6LzADpLvX
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1q9tgkga69k094n5v0pn7ewmpp2kn66sh9hu65gq
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
l9n7b5f2r
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.156.72.39
185.156.72.39
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x00090000000241a9-148.dat family_phorphiex -
Xmrig family
-
XMRig Miner payload 20 IoCs
resource yara_rule behavioral1/memory/3344-221-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-222-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-223-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-224-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-219-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-218-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-225-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/3344-226-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2488-243-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2488-247-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2488-246-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2488-244-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2488-245-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2488-248-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/5016-266-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/5016-268-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/5016-267-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/5016-265-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/5016-270-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/5016-269-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 3 IoCs
flow pid Process 1 3528 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe 85 3076 485420491.exe 34 6064 A1CE.exe -
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation 2032529430.exe Key value queried \REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation 175526431.exe -
Executes dropped EXE 24 IoCs
pid Process 6064 A1CE.exe 1248 243152542.exe 5152 syscrondvr.exe 4532 syscrondvr.exe 5384 2032529430.exe 3076 485420491.exe 2476 1953811601.exe 2972 269249807.exe 4664 175526431.exe 4516 2378029480.exe 5728 sysmtdrav.exe 2832 sysmtdrav.exe 1608 sysmtdrav.exe 5572 sysmtdrav.exe 6036 sysmtdrav.exe 1640 sysmtdrav.exe 2232 sysmtdrav.exe 4084 sysmtdrav.exe 2916 sysmtdrav.exe 2344 sysmtdrav.exe 4676 sysmtdrav.exe 1020 sysmtdrav.exe 4800 sysmtdrav.exe 4268 sysmtdrav.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syscrondvr.exe" 243152542.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 5728 set thread context of 1248 5728 sysmtdrav.exe 135 PID 5728 set thread context of 3344 5728 sysmtdrav.exe 136 PID 2832 set thread context of 2488 2832 sysmtdrav.exe 138 PID 1608 set thread context of 5016 1608 sysmtdrav.exe 140 PID 5572 set thread context of 4308 5572 sysmtdrav.exe 142 PID 6036 set thread context of 5420 6036 sysmtdrav.exe 144 PID 1640 set thread context of 1284 1640 sysmtdrav.exe 146 PID 2232 set thread context of 380 2232 sysmtdrav.exe 148 PID 4084 set thread context of 5208 4084 sysmtdrav.exe 150 PID 2916 set thread context of 4772 2916 sysmtdrav.exe 152 PID 2344 set thread context of 4932 2344 sysmtdrav.exe 154 PID 4676 set thread context of 1168 4676 sysmtdrav.exe 156 PID 1020 set thread context of 4644 1020 sysmtdrav.exe 158 PID 4800 set thread context of 4576 4800 sysmtdrav.exe 160 PID 4268 set thread context of 2864 4268 sysmtdrav.exe 162 -
resource yara_rule behavioral1/memory/3344-213-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-214-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-216-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-221-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-222-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-223-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-224-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-219-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-215-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-218-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-217-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-225-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/3344-226-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2488-243-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2488-247-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2488-246-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2488-244-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2488-245-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2488-248-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/5016-266-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/5016-268-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/5016-267-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/5016-265-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/5016-270-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/5016-269-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleCrashHandler64.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_da.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_es-419.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_gu.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_kn.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ru.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_sl.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_sr.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdateComRegisterShell64.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_bg.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_th.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ur.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_fi.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_hr.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ja.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_lv.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdateCore.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdateBroker.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_sw.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdateSetup.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\psmachine_64.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_fil.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_pt-PT.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_te.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_tr.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_zh-CN.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_zh-TW.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdate.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\psuser_64.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_es.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_et.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_pl.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ca.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_hi.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_en.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\psmachine.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_pt-BR.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdateSetup.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ar.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_en-GB.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_sk.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ta.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_de.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_fr.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_iw.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_no.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_sv.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_vi.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdate.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleUpdateOnDemand.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_fa.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_lt.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUTA347.tmp 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\GoogleCrashHandler.exe 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_bn.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_cs.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_is.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ko.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_uk.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_am.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ml.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_mr.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_ro.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Google\Temp\GUMA346.tmp\goopdateres_el.dll 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\syscrondvr.exe 243152542.exe File opened for modification C:\Windows\syscrondvr.exe 243152542.exe -
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3116 sc.exe 4884 sc.exe 4632 sc.exe 4268 sc.exe 4232 sc.exe 1776 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 269249807.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1CE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243152542.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syscrondvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485420491.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1953811601.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 5384 2032529430.exe 4664 175526431.exe 4516 2378029480.exe 4516 2378029480.exe 4516 2378029480.exe 4516 2378029480.exe 5728 sysmtdrav.exe 5728 sysmtdrav.exe 1248 conhost.exe 2832 sysmtdrav.exe 1248 conhost.exe 1608 sysmtdrav.exe 1248 conhost.exe 5572 sysmtdrav.exe 1248 conhost.exe 6036 sysmtdrav.exe 1248 conhost.exe 1640 sysmtdrav.exe 1248 conhost.exe 2232 sysmtdrav.exe 1248 conhost.exe 4084 sysmtdrav.exe 1248 conhost.exe 2916 sysmtdrav.exe 1248 conhost.exe 2344 sysmtdrav.exe 1248 conhost.exe 4676 sysmtdrav.exe 1248 conhost.exe 1020 sysmtdrav.exe 1248 conhost.exe 4800 sysmtdrav.exe 1248 conhost.exe 4268 sysmtdrav.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 5384 2032529430.exe Token: SeDebugPrivilege 4664 175526431.exe Token: SeLockMemoryPrivilege 3344 dwm.exe Token: SeLockMemoryPrivilege 2488 dwm.exe Token: SeLockMemoryPrivilege 5016 dwm.exe Token: SeLockMemoryPrivilege 4308 dwm.exe Token: SeLockMemoryPrivilege 5420 dwm.exe Token: SeLockMemoryPrivilege 1284 dwm.exe Token: SeLockMemoryPrivilege 380 dwm.exe Token: SeLockMemoryPrivilege 5208 dwm.exe Token: SeLockMemoryPrivilege 4772 dwm.exe Token: SeLockMemoryPrivilege 4932 dwm.exe Token: SeLockMemoryPrivilege 1168 dwm.exe Token: SeLockMemoryPrivilege 4644 dwm.exe Token: SeLockMemoryPrivilege 4576 dwm.exe Token: SeLockMemoryPrivilege 2864 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 6064 3528 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe 88 PID 3528 wrote to memory of 6064 3528 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe 88 PID 3528 wrote to memory of 6064 3528 2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe 88 PID 6064 wrote to memory of 1248 6064 A1CE.exe 97 PID 6064 wrote to memory of 1248 6064 A1CE.exe 97 PID 6064 wrote to memory of 1248 6064 A1CE.exe 97 PID 1248 wrote to memory of 5152 1248 243152542.exe 100 PID 1248 wrote to memory of 5152 1248 243152542.exe 100 PID 1248 wrote to memory of 5152 1248 243152542.exe 100 PID 5172 wrote to memory of 4532 5172 cmd.exe 101 PID 5172 wrote to memory of 4532 5172 cmd.exe 101 PID 5172 wrote to memory of 4532 5172 cmd.exe 101 PID 5152 wrote to memory of 5384 5152 syscrondvr.exe 103 PID 5152 wrote to memory of 5384 5152 syscrondvr.exe 103 PID 5384 wrote to memory of 6100 5384 2032529430.exe 104 PID 5384 wrote to memory of 6100 5384 2032529430.exe 104 PID 6100 wrote to memory of 3116 6100 cmd.exe 106 PID 6100 wrote to memory of 3116 6100 cmd.exe 106 PID 6100 wrote to memory of 5292 6100 cmd.exe 107 PID 6100 wrote to memory of 5292 6100 cmd.exe 107 PID 5152 wrote to memory of 3076 5152 syscrondvr.exe 116 PID 5152 wrote to memory of 3076 5152 syscrondvr.exe 116 PID 5152 wrote to memory of 3076 5152 syscrondvr.exe 116 PID 5152 wrote to memory of 2476 5152 syscrondvr.exe 117 PID 5152 wrote to memory of 2476 5152 syscrondvr.exe 117 PID 5152 wrote to memory of 2476 5152 syscrondvr.exe 117 PID 5152 wrote to memory of 2972 5152 syscrondvr.exe 118 PID 5152 wrote to memory of 2972 5152 syscrondvr.exe 118 PID 5152 wrote to memory of 2972 5152 syscrondvr.exe 118 PID 5152 wrote to memory of 4664 5152 syscrondvr.exe 119 PID 5152 wrote to memory of 4664 5152 syscrondvr.exe 119 PID 4664 wrote to memory of 3292 4664 175526431.exe 120 PID 4664 wrote to memory of 3292 4664 175526431.exe 120 PID 3292 wrote to memory of 4884 3292 cmd.exe 122 PID 3292 wrote to memory of 4884 3292 cmd.exe 122 PID 3292 wrote to memory of 5408 3292 cmd.exe 123 PID 3292 wrote to memory of 5408 3292 cmd.exe 123 PID 3076 wrote to memory of 4516 3076 485420491.exe 125 PID 3076 wrote to memory of 4516 3076 485420491.exe 125 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 1248 5728 sysmtdrav.exe 135 PID 5728 wrote to memory of 3344 5728 sysmtdrav.exe 136 PID 5728 wrote to memory of 3344 5728 sysmtdrav.exe 136 PID 5728 wrote to memory of 3344 5728 sysmtdrav.exe 136 PID 5728 wrote to memory of 3344 5728 sysmtdrav.exe 136 PID 5728 wrote to memory of 3344 5728 sysmtdrav.exe 136 PID 2832 wrote to memory of 2488 2832 sysmtdrav.exe 138 PID 2832 wrote to memory of 2488 2832 sysmtdrav.exe 138 PID 2832 wrote to memory of 2488 2832 sysmtdrav.exe 138 PID 2832 wrote to memory of 2488 2832 sysmtdrav.exe 138 PID 2832 wrote to memory of 2488 2832 sysmtdrav.exe 138 PID 1608 wrote to memory of 5016 1608 sysmtdrav.exe 140 PID 1608 wrote to memory of 5016 1608 sysmtdrav.exe 140 PID 1608 wrote to memory of 5016 1608 sysmtdrav.exe 140 PID 1608 wrote to memory of 5016 1608 sysmtdrav.exe 140 PID 1608 wrote to memory of 5016 1608 sysmtdrav.exe 140 PID 5572 wrote to memory of 4308 5572 sysmtdrav.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-14_c634a26757ae56a86172dc49678e7f0f_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer.exe"1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\A1CE.exe"C:\Users\Admin\AppData\Local\Temp\A1CE.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\243152542.exeC:\Users\Admin\AppData\Local\Temp\243152542.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\2032529430.exeC:\Users\Admin\AppData\Local\Temp\2032529430.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc delete "DrvTcfgsvc" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvTcfgsvc" /f6⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\system32\sc.exesc delete "DrvTcfgsvc"7⤵
- Launches sc.exe
PID:3116
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvTcfgsvc" /f7⤵PID:5292
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\485420491.exeC:\Users\Admin\AppData\Local\Temp\485420491.exe5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\2378029480.exeC:\Users\Admin\AppData\Local\Temp\2378029480.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4516 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "MgrSrvdrvcs"7⤵
- Launches sc.exe
PID:4632
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "MgrSrvdrvcs" binpath= "C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe" start= "auto"7⤵
- Launches sc.exe
PID:4268
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog7⤵
- Launches sc.exe
PID:4232
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "MgrSrvdrvcs"7⤵
- Launches sc.exe
PID:1776
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1953811601.exeC:\Users\Admin\AppData\Local\Temp\1953811601.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\269249807.exeC:\Users\Admin\AppData\Local\Temp\269249807.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\175526431.exeC:\Users\Admin\AppData\Local\Temp\175526431.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc delete "DrvCfgSvcs" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvCfgSvcs" /f6⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\system32\sc.exesc delete "DrvCfgSvcs"7⤵
- Launches sc.exe
PID:4884
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvCfgSvcs" /f7⤵PID:5408
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\syscrondvr.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe2⤵
- Executes dropped EXE
PID:4532
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exeC:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1248 -
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6036 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5420
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2232 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4084 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5208
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4676 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1020 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4800 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4268 -
C:\Windows\system32\dwm.exedwm.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
-
-
C:\Windows\system32\dwm.exedwm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD5fff5cbccb6b31b40f834b8f4778a779a
SHA1899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA5121a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
-
Filesize
8KB
MD50cd27d2aa3bc58e4fc3c6639f4797e55
SHA11224947928cbdb0634d3aa7b374825552fe20fde
SHA256559dfe706ff2f2ce820748d25a91173972c89f6bb9510fba52f40815f018621c
SHA5129a595bfaa5ed85d895337a488969d75a00f33a6dd4e8759b95179428ea44922cccbef6189f08579ff806fe030e9833506c0aa8fedd1108622ffed3d0815d7d62
-
Filesize
20KB
MD5680f371f2918acd9c01ebd9b2624e191
SHA12f6d2bc41d8ec3c2cdddeb894f8af082a51acfa9
SHA2565cf738edd0028523f23a77d7dc02087e6f99cf1110f5b51766bf79f00bff6d09
SHA512df251b794acf1ede346f0b01bca3fe576b0d36d127f33e4942e8093625a40d6b74ec26fc51111ebba705a1e9c37d923069de98d2658b416d1f7410846f873e40
-
Filesize
8KB
MD5c2252ee01d47f885c466fea46d77b337
SHA10e5e5e21dfdd47632831935e98d46fb4c4bf9168
SHA2567563681ee1464143363b1b7b6d59cef4c2a3b9a431c94feae043465cc7d23be0
SHA5128e0fdf90fc8c1c014b6c183dafa58ccf18251a3ea2e279c671a35ff702b60a5be3058c2eceac7a00e4b747796b1e1ed10a64abf95f26bd288980592db4e690d7
-
Filesize
2.5MB
MD50000638ebbfe0d620abe6ca32abb1b58
SHA1ae908681544765eb238e92b4ff7df26884692aa0
SHA256267ec6176c1111d9ffcf32fcfa6aa65917e64d1556dcbbd8989ee6bbebc2e72f
SHA5121522ed6c96d0a6699aaf5c1e6e3956742f26e8b46f2c795c0b6cfd3c02421aa6101134ded49c6b97e4085a789056cfb2d0fa09630c1c8796c7fc8d49aef66212
-
Filesize
80KB
MD5f30fdbf3448f67cbc3566f31729cb7a6
SHA1fbf005c38f4a1c2e86817a2cb70406fc241f2c90
SHA25681783b558904becc5b86553faba9525070de5f43339766eb1c025bcfbfe1eef8
SHA512b428df2c8f8b4a002c8d7e1bfd9926e5cf95ee998688a2c360b8551e80be5bfbfa17ef210bea35f247da4a5c8a940fb5dba49f4786da9a74e5d001b771c8e9a8
-
Filesize
51KB
MD5588e67994dd9e1084cbe989ee0d7eecd
SHA11a9e7f30d4b14b2054c6947ec7b25024dac5c50e
SHA256d6a96251f4bd75df5e68bbc2ce0cea37e0c5fadf1bace5b035245832930a4d2c
SHA512ad9f235b9c03c391d2cd10f1fc0d07d748b305a254dc310da0ad6e1b27160f65a811a1586a632c4f331c5660a2cb77dec8f06b163c6c226f6a2c39b0d13af25e
-
Filesize
10KB
MD5c08cfa523c9377d3ae24fdb373b3ae13
SHA15289219770ad28b0fa4f0bdd91817f76bd6be222
SHA256326c70a965d4e642275c26cd913e268b1db89edd59b31a86ee600a7a9c664eb0
SHA512c91acd580ac832d5fed363a9a2b98b724a255d82e4fdda6eca62133feb5e60dd79a8caca36597a52bfbfa907a44208c48b15142e2e6020db219d14e970c3f57c
-
Filesize
10KB
MD50ec46393976eb51f307cc11d80bae845
SHA169d4cb168f3a1b97c37a0ba1519d0adb1ff7e245
SHA256252171bdaa35d19f872c165e861b03d347a4afb85d7a03d02f8eae09d191038d
SHA512803351760e3c422e4825103235e13085004b3418b483a2c646aafaef62b7212a1ba4ed28469134a236c5b6121e6a748ba958bbae2dbe4afe9f9f45704928d31f
-
Filesize
14KB
MD50c0195c48b6b8582fa6f6373032118da
SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
SHA512ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d