citadel | 317f3810f9f40e81f13ed74090127fb880addb7265dcfc26a01dc7d323ea45fc

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/02/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Size 452KB
Sample260215-cbdefag12d
SHA256 317f3810f9f40e81f13ed74090127fb880addb7265dcfc26a01dc7d323ea45fc
MD5 d2fd3452c9a0583a080b4f46f3261014
SHA1 485ddd963bb6cb28aaf755e4017d10d5182ecfb9
SHA512 53e90e9868ddb7cdf8e5619d45d699e5f597a36a382fc04d7b3881a39cf1adcacf21137517b69b6002cf183529aaeb4743e7108c19664cbb7e9f60b8d4ebb87f
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cHb:S8a3P56/0WjYtzYebM8ENpCw6ffHb
TLSH
T1B2A4BFE2B102C596E8F708767A4A84A035FBB85EE8D1921F76D8570E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware botnet discovery citadel persistence spyware stealer trojan

Malware Config

Signatures

Citadel
Citadel is a trojan and botnet written in C.
trojan botnet citadel
Citadel family
citadel

Detects Citadel payload 41 IoCs

resource	yara_rule
behavioral1/memory/5164-11-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-16-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-19-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-18-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-17-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-15-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/4536-34-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/4536-36-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-39-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-43-0x0000000000710000-0x000000000074B000-memory.dmp	family_citadel
behavioral1/memory/4536-42-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/4536-47-0x0000000002040000-0x000000000207B000-memory.dmp	family_citadel
behavioral1/memory/5108-50-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5108-45-0x0000000000710000-0x000000000074B000-memory.dmp	family_citadel
behavioral1/memory/4536-52-0x0000000002040000-0x000000000207B000-memory.dmp	family_citadel
behavioral1/memory/4536-59-0x0000000002040000-0x000000000207B000-memory.dmp	family_citadel
behavioral1/memory/548-72-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-71-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/4536-81-0x0000000002040000-0x000000000207B000-memory.dmp	family_citadel
behavioral1/memory/4536-76-0x0000000002040000-0x000000000207B000-memory.dmp	family_citadel
behavioral1/memory/548-70-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-69-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-67-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-66-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-65-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-64-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-62-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-68-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-63-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/6020-86-0x00000000001A0000-0x00000000001DB000-memory.dmp	family_citadel
behavioral1/memory/1116-95-0x0000000000B40000-0x0000000000B7B000-memory.dmp	family_citadel
behavioral1/memory/6020-90-0x00000000001A0000-0x00000000001DB000-memory.dmp	family_citadel
behavioral1/memory/5492-117-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/340-109-0x0000000000320000-0x000000000035B000-memory.dmp	family_citadel
behavioral1/memory/4536-110-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/5492-107-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/3900-122-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/3900-124-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-127-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-155-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral1/memory/548-185-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	help.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	ililb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	baef.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	ililb.exe

Executes dropped EXE 8 IoCs

pid	Process
2664	help.exe
5248	ililb.exe
4536	help.exe
548	ililb.exe
6020	baef.exe
1348	ililb.exe
5492	baef.exe
3900	ililb.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	help.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	help.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	ililb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	ililb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bikut = "C:\\Users\\Admin\\AppData\\Roaming\\Mezuxo\\ililb.exe"	ililb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	ililb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	ililb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	baef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	baef.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	4684	WerFault.exe	87

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 4684	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	87
PID 2664 set thread context of 5164	2664	help.exe	95
PID 4776 set thread context of 5108	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	96
PID 5248 set thread context of 536	5248	ililb.exe	99
PID 2664 set thread context of 4536	2664	help.exe	102
PID 5248 set thread context of 548	5248	ililb.exe	103
PID 4536 set thread context of 6020	4536	help.exe	108
PID 6020 set thread context of 1116	6020	baef.exe	109
PID 6020 set thread context of 1116	6020	baef.exe	109
PID 1348 set thread context of 5688	1348	ililb.exe	112
PID 6020 set thread context of 5492	6020	baef.exe	113
PID 6020 set thread context of 5492	6020	baef.exe	113
PID 4536 set thread context of 340	4536	help.exe	114
PID 1348 set thread context of 3900	1348	ililb.exe	116

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ililb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ililb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ililb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Privacy	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
2664	help.exe
2664	help.exe
2664	help.exe
2664	help.exe
5248	ililb.exe
5248	ililb.exe
5248	ililb.exe
5248	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
6020	baef.exe
6020	baef.exe
6020	baef.exe
6020	baef.exe
1348	ililb.exe
1348	ililb.exe
1348	ililb.exe
1348	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe
548	ililb.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5108	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Token: SeSecurityPrivilege	5108	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe
Token: SeSecurityPrivilege	4536	help.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
2664	help.exe
2664	help.exe
5248	ililb.exe
5248	ililb.exe
6020	baef.exe
6020	baef.exe
1348	ililb.exe
1348	ililb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4684	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	87
PID 4776 wrote to memory of 4684	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	87
PID 4776 wrote to memory of 4684	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	87
PID 2664 wrote to memory of 5164	2664	help.exe	95
PID 2664 wrote to memory of 5164	2664	help.exe	95
PID 2664 wrote to memory of 5164	2664	help.exe	95
PID 2664 wrote to memory of 5164	2664	help.exe	95
PID 2664 wrote to memory of 5164	2664	help.exe	95
PID 4776 wrote to memory of 5108	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	96
PID 4776 wrote to memory of 5108	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	96
PID 4776 wrote to memory of 5108	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	96
PID 4776 wrote to memory of 5108	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	96
PID 4776 wrote to memory of 5108	4776	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	96
PID 5108 wrote to memory of 5248	5108	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	98
PID 5248 wrote to memory of 536	5248	ililb.exe	99
PID 5248 wrote to memory of 536	5248	ililb.exe	99
PID 5248 wrote to memory of 536	5248	ililb.exe	99
PID 5248 wrote to memory of 536	5248	ililb.exe	99
PID 5248 wrote to memory of 536	5248	ililb.exe	99
PID 2664 wrote to memory of 4536	2664	help.exe	102
PID 2664 wrote to memory of 4536	2664	help.exe	102
PID 2664 wrote to memory of 4536	2664	help.exe	102
PID 2664 wrote to memory of 4536	2664	help.exe	102
PID 2664 wrote to memory of 4536	2664	help.exe	102
PID 5248 wrote to memory of 548	5248	ililb.exe	103
PID 5248 wrote to memory of 548	5248	ililb.exe	103
PID 5248 wrote to memory of 548	5248	ililb.exe	103
PID 5248 wrote to memory of 548	5248	ililb.exe	103
PID 5248 wrote to memory of 548	5248	ililb.exe	103
PID 548 wrote to memory of 2976	548	ililb.exe	50
PID 548 wrote to memory of 2692	548	ililb.exe	51
PID 548 wrote to memory of 1056	548	ililb.exe	52
PID 548 wrote to memory of 3300	548	ililb.exe	56
PID 548 wrote to memory of 3440	548	ililb.exe	57
PID 548 wrote to memory of 3624	548	ililb.exe	58
PID 548 wrote to memory of 3716	548	ililb.exe	59
PID 548 wrote to memory of 3776	548	ililb.exe	60
PID 548 wrote to memory of 3860	548	ililb.exe	61
PID 548 wrote to memory of 4048	548	ililb.exe	62
PID 548 wrote to memory of 4396	548	ililb.exe	65
PID 548 wrote to memory of 1232	548	ililb.exe	78
PID 548 wrote to memory of 5828	548	ililb.exe	79
PID 548 wrote to memory of 4440	548	ililb.exe	84
PID 548 wrote to memory of 5892	548	ililb.exe	92
PID 548 wrote to memory of 5108	548	ililb.exe	96
PID 5108 wrote to memory of 5268	5108	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	104
PID 548 wrote to memory of 4912	548	ililb.exe	97
PID 548 wrote to memory of 4536	548	ililb.exe	102
PID 4536 wrote to memory of 6020	4536	help.exe	108
PID 4536 wrote to memory of 6020	4536	help.exe	108
PID 6020 wrote to memory of 1116	6020	baef.exe	109
PID 6020 wrote to memory of 1116	6020	baef.exe	109
PID 6020 wrote to memory of 1116	6020	baef.exe	109
PID 6020 wrote to memory of 1116	6020	baef.exe	109
PID 6020 wrote to memory of 1116	6020	baef.exe	109
PID 6020 wrote to memory of 1116	6020	baef.exe	109
PID 1348 wrote to memory of 5688	1348	ililb.exe	112
PID 1348 wrote to memory of 5688	1348	ililb.exe	112
PID 1348 wrote to memory of 5688	1348	ililb.exe	112
PID 6020 wrote to memory of 5492	6020	baef.exe	113
PID 6020 wrote to memory of 5492	6020	baef.exe	113
PID 6020 wrote to memory of 5492	6020	baef.exe	113
PID 6020 wrote to memory of 5492	6020	baef.exe	113
PID 6020 wrote to memory of 5492	6020	baef.exe	113

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2692

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:1056

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3300
- C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:4684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 84
      4⤵
      Program crash
      PID:2024
- - C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
      "C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5248
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
        
        C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe325a076.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3624

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3716

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1232

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5828

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4684 -ip 4684
1⤵
PID:2012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5892

C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:5164
- C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
  C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Users\Admin\AppData\Roaming\Udloxa\baef.exe
    "C:\Users\Admin\AppData\Roaming\Udloxa\baef.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:1116
  - - C:\Users\Admin\AppData\Roaming\Udloxa\baef.exe
      C:\Users\Admin\AppData\Roaming\Udloxa\baef.exe
      4⤵
      Executes dropped EXE
      PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp35b2bb1d.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:316

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4912

C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
  C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
  2⤵
  - Executes dropped EXE
  PID:3900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpe325a076.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpe325a076.bat
Size 293B
SHA256 b2ec4dd77ac9d102ee617cf0ec4b8337221aa85c9c2d59ae013d7a169a9510a3
MD5 3bf1935b56c92b3064c24dcfac90e90b
SHA1 ffe828fd165aaae30b3d520cf860c8444242e100
SHA512 b975e47465c8c3739b51f36424a9269d98f46e18c49a6a40d614036f1de77e220fc2d297015953cd45db289b1dc9063bcb45a0614b1f5e6a9e8584a17af618d0
TLSH
T1EBE0C212D0AFCB3B0848505787F76A8DE0B56D956ECA23546760C84A62D248FFA97381
MD5 SHA1 SHA512 TLSH

Submit Download

kedyh.sii

Path C:\Users\Admin\AppData\Roaming\Ebvaam\kedyh.sii
Size 3KB
SHA256 698de22954784c119aaa103169ab5677fb4adb153018ffb7e5e9817efbdb633d
MD5 1eac734e4e9987efb93bb4322a8691fe
SHA1 ffc339d85edcaac9da78d82b5d9da3d9a381f9d9
SHA512 5493532c72b213367864477cca8435ce7abf1f5a88e210b56d6308e7e84b356474d84766056c8e5e2317c5ef61c8021af60eca40fa3b2b9ace83121526ce32da
TLSH
T15A716C87C6D79EC60384213E26ED8A0DA898CB657E3E01C340340945EEA8AC38D7DD8F
MD5 SHA1 SHA512 TLSH

Submit Download

help.exe

Path C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
Size 452KB
SHA256 317f3810f9f40e81f13ed74090127fb880addb7265dcfc26a01dc7d323ea45fc
MD5 d2fd3452c9a0583a080b4f46f3261014
SHA1 485ddd963bb6cb28aaf755e4017d10d5182ecfb9
SHA512 53e90e9868ddb7cdf8e5619d45d699e5f597a36a382fc04d7b3881a39cf1adcacf21137517b69b6002cf183529aaeb4743e7108c19664cbb7e9f60b8d4ebb87f
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cHb:S8a3P56/0WjYtzYebM8ENpCw6ffHb
TLSH
T1B2A4BFE2B102C596E8F708767A4A84A035FBB85EE8D1921F76D8570E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ililb.exe

Path C:\Users\Admin\AppData\Roaming\Mezuxo\ililb.exe
Size 452KB
SHA256 9245b4130fcca28b80f3a96e637f118037891f31e52d7212e4378201559c5887
MD5 8b5824ba1c8859e7b852d45ba2898185
SHA1 7e7b678d3e6eb4c99812dc37f3af02290f6074d7
SHA512 e77fb9e9c1f48c06e27f11459f8317e8584ccc73809c39491365f96b71aa7154f8df7c1d3ed3f2c4a0359fd58e48a629cf66b7339697697a42b07ce6e95a8233
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cwy:S8a3P56/0WjYtzYebM8ENpCw6ffwy
TLSH
T183A4BFE2B102C596E8F708777A4A84A035FBB85EE8D1921F76D8570E56F3301109AF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baef.exe

Path C:\Users\Admin\AppData\Roaming\Udloxa\baef.exe
Size 452KB
SHA256 40e24136bb92ab563afc246ff59896c9f1ca2ce4dbe5381273d1255ca401c260
MD5 81440dc0c7f8f9f2679fd29923c86382
SHA1 7c0148825fc5a2f232ad9aac5c1ea879ae3ebe7e
SHA512 db18bcf30d515fc91adc2b5a6faf521189d0a768b77f88bdeef704e3e043b53043eebd5ed5b2738ee0560f7c54cd48c5116760c96760c4dc9997ed1476e51a09
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cR:S8a3P56/0WjYtzYebM8ENpCw6ffR
TLSH
T156A4BFE2B102C596E8F708767A4A84A035FBB85EE8D1921F76D8570E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/340-144-0x0000000000B80000-0x0000000000C16000-memory.dmp

Download

memory/340-132-0x0000000000B80000-0x0000000000C16000-memory.dmp

Download

memory/340-109-0x0000000000320000-0x000000000035B000-memory.dmp

Download

memory/548-130-0x00000000020D0000-0x00000000020DF000-memory.dmp

Download

memory/548-62-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-127-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-66-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-67-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-39-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-69-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-70-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-64-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-65-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-129-0x0000000003410000-0x0000000003428000-memory.dmp

Download

memory/548-131-0x0000000003AC0000-0x0000000003AC8000-memory.dmp

Download

memory/548-128-0x0000000000530000-0x00000000005C6000-memory.dmp

Download

memory/548-63-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-68-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-155-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-72-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-71-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/548-185-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1116-95-0x0000000000B40000-0x0000000000B7B000-memory.dmp

Download

memory/1348-123-0x0000000000890000-0x0000000000926000-memory.dmp

Download

memory/2664-35-0x0000000000780000-0x0000000000816000-memory.dmp

Download

memory/3900-122-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3900-126-0x0000000000820000-0x00000000008B6000-memory.dmp

Download

memory/3900-124-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4536-114-0x00000000020D0000-0x00000000020E8000-memory.dmp

Download

memory/4536-36-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4536-81-0x0000000002040000-0x000000000207B000-memory.dmp

Download

memory/4536-59-0x0000000002040000-0x000000000207B000-memory.dmp

Download

memory/4536-52-0x0000000002040000-0x000000000207B000-memory.dmp

Download

memory/4536-115-0x00000000020F0000-0x00000000020FF000-memory.dmp

Download

memory/4536-34-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4536-47-0x0000000002040000-0x000000000207B000-memory.dmp

Download

memory/4536-42-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4536-76-0x0000000002040000-0x000000000207B000-memory.dmp

Download

memory/4536-113-0x0000000000780000-0x0000000000816000-memory.dmp

Download

memory/4536-110-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4536-116-0x0000000002080000-0x0000000002092000-memory.dmp

Download

memory/4776-14-0x0000000000940000-0x00000000009D6000-memory.dmp

Download

memory/4776-0-0x00000000004F0000-0x00000000004F4000-memory.dmp

Download

memory/5108-50-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5108-15-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5108-18-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5108-17-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5108-45-0x0000000000710000-0x000000000074B000-memory.dmp

Download

memory/5108-43-0x0000000000710000-0x000000000074B000-memory.dmp

Download

memory/5108-19-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5108-49-0x0000000000A70000-0x0000000000B06000-memory.dmp

Download

memory/5108-16-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5164-11-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5248-40-0x00000000008B0000-0x0000000000946000-memory.dmp

Download

memory/5248-29-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5492-117-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5492-107-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/5492-119-0x00000000008C0000-0x0000000000956000-memory.dmp

Download

memory/6020-90-0x00000000001A0000-0x00000000001DB000-memory.dmp

Download

memory/6020-86-0x00000000001A0000-0x00000000001DB000-memory.dmp

Download

memory/6020-106-0x0000000000910000-0x00000000009A6000-memory.dmp

Download