citadel | 317f3810f9f40e81f13ed74090127fb880addb7265dcfc26a01dc7d323ea45fc

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/02/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Size 452KB
Sample260215-cbdefag12d
SHA256 317f3810f9f40e81f13ed74090127fb880addb7265dcfc26a01dc7d323ea45fc
MD5 d2fd3452c9a0583a080b4f46f3261014
SHA1 485ddd963bb6cb28aaf755e4017d10d5182ecfb9
SHA512 53e90e9868ddb7cdf8e5619d45d699e5f597a36a382fc04d7b3881a39cf1adcacf21137517b69b6002cf183529aaeb4743e7108c19664cbb7e9f60b8d4ebb87f
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cHb:S8a3P56/0WjYtzYebM8ENpCw6ffHb
TLSH
T1B2A4BFE2B102C596E8F708767A4A84A035FBB85EE8D1921F76D8570E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware botnet discovery citadel persistence spyware stealer trojan

Malware Config

Signatures

Citadel
Citadel is a trojan and botnet written in C.
trojan botnet citadel
Citadel family
citadel

Detects Citadel payload 34 IoCs

resource	yara_rule
behavioral2/memory/2600-5-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/4932-15-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/4932-16-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/4932-18-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/4932-19-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/3844-38-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/4932-40-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/3844-42-0x0000000002060000-0x000000000209B000-memory.dmp	family_citadel
behavioral2/memory/3844-37-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/3844-45-0x0000000002060000-0x000000000209B000-memory.dmp	family_citadel
behavioral2/memory/3844-52-0x0000000002060000-0x000000000209B000-memory.dmp	family_citadel
behavioral2/memory/1060-55-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-56-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-58-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-64-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-63-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/3844-68-0x0000000002060000-0x000000000209B000-memory.dmp	family_citadel
behavioral2/memory/3844-71-0x0000000002060000-0x000000000209B000-memory.dmp	family_citadel
behavioral2/memory/1060-62-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-59-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-60-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-57-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-54-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-61-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/3940-76-0x00000000001A0000-0x00000000001DB000-memory.dmp	family_citadel
behavioral2/memory/3940-80-0x00000000001A0000-0x00000000001DB000-memory.dmp	family_citadel
behavioral2/memory/3312-85-0x0000000000B70000-0x0000000000BAB000-memory.dmp	family_citadel
behavioral2/memory/3980-99-0x0000000000700000-0x000000000073B000-memory.dmp	family_citadel
behavioral2/memory/3844-101-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/4216-103-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/344-108-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-110-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-115-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/1060-122-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	help.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	yhxir.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	arza.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif	yhxir.exe

Executes dropped EXE 8 IoCs

pid	Process
4596	help.exe
3832	yhxir.exe
3844	help.exe
1060	yhxir.exe
3940	arza.exe
4800	yhxir.exe
4216	arza.exe
344	yhxir.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	help.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	yhxir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	yhxir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	arza.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	yhxir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	yhxir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	help.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exemfu = "C:\\Users\\Admin\\AppData\\Roaming\\Miponi\\yhxir.exe"	yhxir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	arza.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 388 set thread context of 2600	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	81
PID 4596 set thread context of 1104	4596	help.exe	84
PID 388 set thread context of 4932	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	85
PID 3832 set thread context of 3916	3832	yhxir.exe	87
PID 4596 set thread context of 3844	4596	help.exe	88
PID 3832 set thread context of 1060	3832	yhxir.exe	89
PID 3844 set thread context of 3940	3844	help.exe	92
PID 3940 set thread context of 3312	3940	arza.exe	93
PID 3940 set thread context of 3312	3940	arza.exe	93
PID 4800 set thread context of 1268	4800	yhxir.exe	96
PID 3940 set thread context of 4216	3940	arza.exe	97
PID 3940 set thread context of 4216	3940	arza.exe	97
PID 3844 set thread context of 3980	3844	help.exe	98
PID 4800 set thread context of 344	4800	yhxir.exe	100

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhxir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	help.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhxir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhxir.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Privacy	help.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	help.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
4596	help.exe
4596	help.exe
4596	help.exe
4596	help.exe
3832	yhxir.exe
3832	yhxir.exe
3832	yhxir.exe
3832	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
3940	arza.exe
3940	arza.exe
3940	arza.exe
3940	arza.exe
4800	yhxir.exe
4800	yhxir.exe
4800	yhxir.exe
4800	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe
1060	yhxir.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4932	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Token: SeSecurityPrivilege	4932	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe
Token: SeSecurityPrivilege	3844	help.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
4596	help.exe
4596	help.exe
3832	yhxir.exe
3832	yhxir.exe
3940	arza.exe
3940	arza.exe
4800	yhxir.exe
4800	yhxir.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2600	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	81
PID 388 wrote to memory of 2600	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	81
PID 388 wrote to memory of 2600	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	81
PID 388 wrote to memory of 2600	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	81
PID 388 wrote to memory of 2600	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	81
PID 4596 wrote to memory of 1104	4596	help.exe	84
PID 4596 wrote to memory of 1104	4596	help.exe	84
PID 4596 wrote to memory of 1104	4596	help.exe	84
PID 4596 wrote to memory of 1104	4596	help.exe	84
PID 4596 wrote to memory of 1104	4596	help.exe	84
PID 388 wrote to memory of 4932	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	85
PID 388 wrote to memory of 4932	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	85
PID 388 wrote to memory of 4932	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	85
PID 388 wrote to memory of 4932	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	85
PID 388 wrote to memory of 4932	388	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	85
PID 4932 wrote to memory of 3832	4932	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	86
PID 3832 wrote to memory of 3916	3832	yhxir.exe	87
PID 3832 wrote to memory of 3916	3832	yhxir.exe	87
PID 3832 wrote to memory of 3916	3832	yhxir.exe	87
PID 3832 wrote to memory of 3916	3832	yhxir.exe	87
PID 3832 wrote to memory of 3916	3832	yhxir.exe	87
PID 4596 wrote to memory of 3844	4596	help.exe	88
PID 4596 wrote to memory of 3844	4596	help.exe	88
PID 4596 wrote to memory of 3844	4596	help.exe	88
PID 4596 wrote to memory of 3844	4596	help.exe	88
PID 4596 wrote to memory of 3844	4596	help.exe	88
PID 3832 wrote to memory of 1060	3832	yhxir.exe	89
PID 3832 wrote to memory of 1060	3832	yhxir.exe	89
PID 3832 wrote to memory of 1060	3832	yhxir.exe	89
PID 3832 wrote to memory of 1060	3832	yhxir.exe	89
PID 3832 wrote to memory of 1060	3832	yhxir.exe	89
PID 4932 wrote to memory of 4612	4932	2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe	90
PID 1060 wrote to memory of 2420	1060	yhxir.exe	51
PID 1060 wrote to memory of 2196	1060	yhxir.exe	52
PID 1060 wrote to memory of 3104	1060	yhxir.exe	53
PID 1060 wrote to memory of 3228	1060	yhxir.exe	54
PID 1060 wrote to memory of 3476	1060	yhxir.exe	56
PID 1060 wrote to memory of 3516	1060	yhxir.exe	57
PID 1060 wrote to memory of 3604	1060	yhxir.exe	58
PID 1060 wrote to memory of 3672	1060	yhxir.exe	59
PID 1060 wrote to memory of 3716	1060	yhxir.exe	60
PID 1060 wrote to memory of 3760	1060	yhxir.exe	61
PID 1060 wrote to memory of 3148	1060	yhxir.exe	62
PID 1060 wrote to memory of 2288	1060	yhxir.exe	78
PID 1060 wrote to memory of 4932	1060	yhxir.exe	85
PID 1060 wrote to memory of 3844	1060	yhxir.exe	88
PID 3844 wrote to memory of 3940	3844	help.exe	92
PID 3844 wrote to memory of 3940	3844	help.exe	92
PID 3940 wrote to memory of 3312	3940	arza.exe	93
PID 3940 wrote to memory of 3312	3940	arza.exe	93
PID 3940 wrote to memory of 3312	3940	arza.exe	93
PID 3940 wrote to memory of 3312	3940	arza.exe	93
PID 3940 wrote to memory of 3312	3940	arza.exe	93
PID 3940 wrote to memory of 3312	3940	arza.exe	93
PID 4800 wrote to memory of 1268	4800	yhxir.exe	96
PID 4800 wrote to memory of 1268	4800	yhxir.exe	96
PID 4800 wrote to memory of 1268	4800	yhxir.exe	96
PID 4800 wrote to memory of 1268	4800	yhxir.exe	96
PID 4800 wrote to memory of 1268	4800	yhxir.exe	96
PID 3940 wrote to memory of 4216	3940	arza.exe	97
PID 3940 wrote to memory of 4216	3940	arza.exe	97
PID 3940 wrote to memory of 4216	3940	arza.exe	97
PID 3940 wrote to memory of 4216	3940	arza.exe	97
PID 3940 wrote to memory of 4216	3940	arza.exe	97

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2196

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3104
- C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2026-02-15_d2fd3452c9a0583a080b4f46f3261014_elex_wannacry.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
      "C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3832
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
        
        C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb9d2dac8.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3228

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3476

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3516

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3672

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3760

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3148

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2288

C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
  C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Users\Admin\AppData\Roaming\Riqy\arza.exe
    "C:\Users\Admin\AppData\Roaming\Riqy\arza.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Roaming\Riqy\arza.exe
      C:\Users\Admin\AppData\Roaming\Riqy\arza.exe
      4⤵
      Executes dropped EXE
      PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp01d13cb3.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3980

C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1268
- C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
  C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
  2⤵
  - Executes dropped EXE
  PID:344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpb9d2dac8.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpb9d2dac8.bat
Size 293B
SHA256 d65ba7d6ec89166b664e396f1a69e977963e1d8518045ac2d4367eeab60990b5
MD5 ef61be3300f4f0ce66781731fe4306a2
SHA1 904559199895f0583bf66580d29f91a00ec3fc6c
SHA512 d47738faefe88419ed5077e9c631ee02a5346613944c36f7324bf270fb46fc65c51419a074b9d75aa349c98543e854abd142679f48b8c29e7f9b96b984aeb4f4
TLSH
T157E0C212D1AFCB3B0848505747F76ACDE0756D556ECA2354AB60C84A61D248FFA87281
MD5 SHA1 SHA512 TLSH

Submit Download

help.exe

Path C:\Users\Admin\AppData\Roaming\InstallDir\help.exe
Size 452KB
SHA256 317f3810f9f40e81f13ed74090127fb880addb7265dcfc26a01dc7d323ea45fc
MD5 d2fd3452c9a0583a080b4f46f3261014
SHA1 485ddd963bb6cb28aaf755e4017d10d5182ecfb9
SHA512 53e90e9868ddb7cdf8e5619d45d699e5f597a36a382fc04d7b3881a39cf1adcacf21137517b69b6002cf183529aaeb4743e7108c19664cbb7e9f60b8d4ebb87f
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cHb:S8a3P56/0WjYtzYebM8ENpCw6ffHb
TLSH
T1B2A4BFE2B102C596E8F708767A4A84A035FBB85EE8D1921F76D8570E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yhxir.exe

Path C:\Users\Admin\AppData\Roaming\Miponi\yhxir.exe
Size 452KB
SHA256 35d37a1aae839430a7194ca73510939168fb2e388f4219853c3b7fd6486ac403
MD5 6ad9794731f3d524bbc3bcfd14d40161
SHA1 2f6c262c1a1a181fa0c4dcede48183dfb7c3bfd5
SHA512 f6f76e46face3b076b3f157b648066fd546e1d35b4b3e72a74fbf7464a64da9b6210a0238e9dce9c39f2b94b747e51738a31993d1ef604aba525ce81ba60ed5d
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cx:S8a3P56/0WjYtzYebM8ENpCw6ffx
TLSH
T15BA4BFE2B102C596E8F708767A4A84A035FBB85EE8D1921F76D8570E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arza.exe

Path C:\Users\Admin\AppData\Roaming\Riqy\arza.exe
Size 452KB
SHA256 de9fe0cc63c37a89e24db00ea87fbcdb7f7ba40efcba53e6e1cada7487a84334
MD5 fa8e4410c6fb1e48b1466a24cb03d01b
SHA1 96b95b4e33eab7ed36af2474bf0af0027a351e79
SHA512 e6e8f7bfd5625584bbe1a012a9068412c39a3aa2e320aeac24e10e2644ed7b95651c3b7725192a273945fad0a7e4f95f64675f1acf7d0a9eefec1d203b7d354a
SSDEEP 6144:VNWRuaNjwyDJ9569Afi0WjwXtzYe+OPy49ob89UPNp4iZcdO5cfaj/cL:S8a3P56/0WjYtzYebM8ENpCw6ffL
TLSH
T16CA4BFE2B102C596E8F708767A4A84A035F7B85EE8D1921F76D8670E56F3301109BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maish.wuy

Path C:\Users\Admin\AppData\Roaming\Vipyi\maish.wuy
Size 3KB
SHA256 da0362a89397f1529e1053227bf03646840670c1338ee97aeffebb2d47120577
MD5 cd8d232dc246a3b7fe819f94043f608c
SHA1 0e22a172987e584bda335764bf17991b47b60a68
SHA512 547c1a1e22ecf9b5b2804e2d1039139e0914484e10c0279a13245915fdf9b56f4258a2b0c3abcc56bb9ca946d917981b7c6ed193fe51db2b73da1ba2121896be
TLSH
T1C8717D80EAB0C411BFE8F0D2AD7CA0DA1DB8637F33141D84591D28A89D350709E6FB65
MD5 SHA1 SHA512 TLSH

Submit Download

memory/344-108-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/388-0-0x0000000002230000-0x0000000002234000-memory.dmp

Download

memory/1060-62-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-60-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-122-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-61-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-54-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-57-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-110-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-59-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-115-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-55-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-56-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-58-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-64-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1060-63-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2600-5-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3312-85-0x0000000000B70000-0x0000000000BAB000-memory.dmp

Download

memory/3832-25-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3844-68-0x0000000002060000-0x000000000209B000-memory.dmp

Download

memory/3844-71-0x0000000002060000-0x000000000209B000-memory.dmp

Download

memory/3844-52-0x0000000002060000-0x000000000209B000-memory.dmp

Download

memory/3844-45-0x0000000002060000-0x000000000209B000-memory.dmp

Download

memory/3844-37-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3844-42-0x0000000002060000-0x000000000209B000-memory.dmp

Download

memory/3844-101-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3844-38-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3940-76-0x00000000001A0000-0x00000000001DB000-memory.dmp

Download

memory/3940-80-0x00000000001A0000-0x00000000001DB000-memory.dmp

Download

memory/3980-99-0x0000000000700000-0x000000000073B000-memory.dmp

Download

memory/4216-103-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4932-40-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4932-19-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4932-18-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4932-16-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4932-15-0x0000000000400000-0x000000000043B000-memory.dmp

Download