Analysis
- max time kernel
34s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 11:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe
Resource
win11-20260130-en
windows11-21h2-x64
22 signatures
150 seconds
General
- Target 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe
- Size 2.5MB
- Sample260420-nf8a6acy4s
- SHA256 4fdfd0b50b7e764494ce8fe060d732df077ebc9a040a3eee4c7bd27c9d4fa1b7
- MD5 ec24700c49dd4d36946195ffdc642852
- SHA1 e92c048823d0b8531464a94f0a8b5faeeeb20892
- SHA512 3fab1bf2abc9faa50e8e25fe170c15319bf08db56935e11e8d6dc8e764f3656b8e7269d3f3de31382026ca5fa0ab1519a37f2fdb3498265e6754db2b0b7f4bd9
- SSDEEP 49152:+1vMj+tQv0PFPbTCHBxKCnFnQXBbrtgb/iQvu0UHOd:+1vMjnWFP6hxvWbrtUTrUHOd
- TLSH T1C6C50212B3C1C8B1EA5BB47116E7EB3ABB3335251333C8876BD42A329FB1516D726251
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" @AE3E3.tmp.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe - Custom signatureDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 36 IoCs
resource yara_rule behavioral2/memory/4864-27-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4864-23-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4864-307-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4864-358-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4864-388-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-431-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-433-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-434-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-436-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-437-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-681-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-680-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-683-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-1080-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2588-435-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1106-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1112-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1113-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1114-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1115-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1116-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1117-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1118-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1119-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1129-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1130-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1140-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1155-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1156-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1163-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1167-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1170-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1173-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1180-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1183-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1460-1187-0x00000000075E0000-0x000000000866E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - Custom signatureUPX dump on OEP (original entry point) 39 IoCs
resource yara_rule behavioral2/memory/4864-22-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/4864-27-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/4864-23-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/4864-307-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/4864-358-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/4864-388-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/4864-425-0x0000000000400000-0x000000000044C000-memory.dmp UPX behavioral2/memory/2588-431-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-433-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-434-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-436-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-437-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-681-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-680-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-683-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-1080-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/2588-1092-0x0000000000400000-0x000000000044C000-memory.dmp UPX behavioral2/memory/2588-435-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/1460-1106-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1112-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1113-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1114-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1115-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1116-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1117-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1118-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1119-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1129-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1130-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1140-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1155-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1156-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1163-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1167-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1170-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1173-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1180-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1183-0x00000000075E0000-0x000000000866E000-memory.dmp UPX behavioral2/memory/1460-1187-0x00000000075E0000-0x000000000866E000-memory.dmp UPX - Executes dropped EXE 7 IoCs
pid Process 4864 @AE3E3.tmp.exe 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 2588 WdExt.exe 2984 launch.exe 4436 wtmps.exe 8 launch.exe 5100 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 4864 @AE3E3.tmp.exe 2588 WdExt.exe - Windows security modification 2 TTPs 37 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AE3E3.tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral2/memory/4864-22-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/4864-27-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/4864-23-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/4864-307-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/4864-358-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/4864-388-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/2588-431-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-433-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-434-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-436-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-437-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-681-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-680-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-683-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-1080-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/2588-435-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/1460-1106-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1112-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1113-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1114-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1115-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1116-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1117-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1118-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1119-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1129-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1130-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1140-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1155-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1156-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1163-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1167-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1170-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1173-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1180-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1183-0x00000000075E0000-0x000000000866E000-memory.dmp upx behavioral2/memory/1460-1187-0x00000000075E0000-0x000000000866E000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI @AE3E3.tmp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @AE3E3.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4864 @AE3E3.tmp.exe 4864 @AE3E3.tmp.exe 4864 @AE3E3.tmp.exe 4864 @AE3E3.tmp.exe 2588 WdExt.exe 2588 WdExt.exe 2588 WdExt.exe 2588 WdExt.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 2984 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 8 launch.exe 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe Token: SeDebugPrivilege 4864 @AE3E3.tmp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3572 wrote to memory of 5072 3572 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 80 PID 3572 wrote to memory of 5072 3572 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 80 PID 3572 wrote to memory of 5072 3572 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 80 PID 5072 wrote to memory of 4864 5072 explorer.exe 81 PID 5072 wrote to memory of 1460 5072 explorer.exe 82 PID 4864 wrote to memory of 812 4864 @AE3E3.tmp.exe 8 PID 4864 wrote to memory of 820 4864 @AE3E3.tmp.exe 9 PID 4864 wrote to memory of 760 4864 @AE3E3.tmp.exe 14 PID 4864 wrote to memory of 2148 4864 @AE3E3.tmp.exe 51 PID 4864 wrote to memory of 2464 4864 @AE3E3.tmp.exe 52 PID 4864 wrote to memory of 3096 4864 @AE3E3.tmp.exe 53 PID 4864 wrote to memory of 3248 4864 @AE3E3.tmp.exe 54 PID 4864 wrote to memory of 3512 4864 @AE3E3.tmp.exe 56 PID 4864 wrote to memory of 3532 4864 @AE3E3.tmp.exe 57 PID 4864 wrote to memory of 3628 4864 @AE3E3.tmp.exe 58 PID 4864 wrote to memory of 3700 4864 @AE3E3.tmp.exe 59 PID 4864 wrote to memory of 3708 4864 @AE3E3.tmp.exe 60 PID 4864 wrote to memory of 3776 4864 @AE3E3.tmp.exe 61 PID 4864 wrote to memory of 4092 4864 @AE3E3.tmp.exe 62 PID 4864 wrote to memory of 5072 4864 @AE3E3.tmp.exe 80 PID 4864 wrote to memory of 1460 4864 @AE3E3.tmp.exe 82 PID 4864 wrote to memory of 1460 4864 @AE3E3.tmp.exe 82 PID 4864 wrote to memory of 3268 4864 @AE3E3.tmp.exe 84 PID 4864 wrote to memory of 4576 4864 @AE3E3.tmp.exe 85 PID 3268 wrote to memory of 2588 3268 cmd.exe 88 PID 2588 wrote to memory of 812 2588 WdExt.exe 8 PID 2588 wrote to memory of 820 2588 WdExt.exe 9 PID 2588 wrote to memory of 760 2588 WdExt.exe 14 PID 2588 wrote to memory of 2148 2588 WdExt.exe 51 PID 2588 wrote to memory of 2464 2588 WdExt.exe 52 PID 2588 wrote to memory of 3096 2588 WdExt.exe 53 PID 2588 wrote to memory of 3248 2588 WdExt.exe 54 PID 2588 wrote to memory of 3512 2588 WdExt.exe 56 PID 2588 wrote to memory of 3532 2588 WdExt.exe 57 PID 2588 wrote to memory of 3628 2588 WdExt.exe 58 PID 2588 wrote to memory of 3700 2588 WdExt.exe 59 PID 2588 wrote to memory of 3708 2588 WdExt.exe 60 PID 2588 wrote to memory of 3776 2588 WdExt.exe 61 PID 2588 wrote to memory of 4092 2588 WdExt.exe 62 PID 2588 wrote to memory of 3268 2588 WdExt.exe 84 PID 2588 wrote to memory of 3268 2588 WdExt.exe 84 PID 2588 wrote to memory of 4616 2588 WdExt.exe 86 PID 2588 wrote to memory of 3480 2588 WdExt.exe 89 PID 3480 wrote to memory of 2984 3480 cmd.exe 91 PID 2984 wrote to memory of 3372 2984 launch.exe 92 PID 3372 wrote to memory of 4436 3372 cmd.exe 94 PID 1460 wrote to memory of 812 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 8 PID 1460 wrote to memory of 820 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 9 PID 1460 wrote to memory of 760 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 14 PID 1460 wrote to memory of 2148 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 51 PID 1460 wrote to memory of 2464 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 52 PID 1460 wrote to memory of 3096 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 53 PID 1460 wrote to memory of 3248 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 54 PID 1460 wrote to memory of 3512 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 56 PID 1460 wrote to memory of 3532 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 57 PID 1460 wrote to memory of 3628 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 58 PID 1460 wrote to memory of 3700 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 59 PID 1460 wrote to memory of 3708 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 60 PID 1460 wrote to memory of 3776 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 61 PID 1460 wrote to memory of 4092 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 62 PID 1460 wrote to memory of 3372 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 92 PID 1460 wrote to memory of 3372 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 92 PID 1460 wrote to memory of 4268 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 93 PID 1460 wrote to memory of 4436 1460 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe 94 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AE3E3.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:820
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:760
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\@AE3E3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AE3E3.tmp.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4616
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"6⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 25888⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:4268
-
-
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe11⤵
- Executes dropped EXE
PID:5100
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
- System Location Discovery: System Language Discovery
PID:4576
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1460
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3248
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3512
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3532
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3628
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3700
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3776
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4092
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:8
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E5807DB_Rar\@AE3E3.tmp.exe
- Size 1.7MB
- SHA256 72b70b2e36135d55e02763d69849de201c424358f474027865e1e1ef3631f39a
- MD5 d2d486eeb3070a71e70680a5ac90a884
- SHA1 e92a0f1287d8e43f0f04373e2114c371db35ae3d
- SHA512 4a79939011529165a52a7e1cde8e8ed85e556681b44b62a17876573b78c2a0b9ca7ce89a446b9a422744dce5fa988d1baca932b64966a4edc64a1bef191baeb2
- SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNx:mbTChxKCnFnQXBbrtgb/iQvu0UHOE
- TLSH T1A78501252390CD61F36FC07283E56F79B6B329213773D8966B4855312BF2E2EE791092
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0E581141_Rar\WdExt.exe
- Size 1.7MB
- SHA256 c25a137cf23e255872a0aec913562ff8a66beebdb525a986b5d9e1e5d71186ba
- MD5 66a920278b77c0aa8b5cb3faf8a4ebe9
- SHA1 dbed75fa83727634ec0c6869ff4d86bb9505077b
- SHA512 654ee39dfc1a09e9af3167be3bb6ec2d64f578f0ef637d50adb84358dec7690bb0e5fcc3a4bca8d49e6619eeb35c60a9ae4ef28be05131128f3e7b594dee116f
- SSDEEP 24576:OXdVtTj2i6BT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNr:mbTC0xKCnFnQXBbrtgb/iQvu0UHOg
- TLSH T1228501252390CD61F36FC07283E56E79B6B329213773D8966B4851312BF2E2FE791192
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.exe
- Size 765KB
- SHA256 48efc1e775c88e01600b049e1e55831fefaea5d624d94892a6efaa632181e2fe
- MD5 1d3072caa9c82faea4ce0aff3c267d5f
- SHA1 45431656c6d6e841c40bc8e80bed891193caff21
- SHA512 9d26e856ace8d48382d16346bff089439f7263b2c3f9c4dbc2cd8a797a704ab2d447df0e303b4a40cead274d0871aec1819ee81c40697efb7c759cae27ff76f5
- SSDEEP 12288:vaWzgMg7v3qnCiGErQohh0F4XCJ8lnytQ94qpHzouoJx9VM:yaHMv6CCrjTnytQ+qpTo5PE
- TLSH T1FCF4CF12F7D680B6D99339B1197BE32BEB3575194327C4C7ABE02E729E111405B3A3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.ini
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-20_ec24700c49dd4d36946195ffdc642852_agent-tesla_backswap_coinminer_darpapox_elex_nymaim_remc.ini
- Size 2KB
- SHA256 2f259409666b84e0c046a170aec8f3b0cd155bf3546f32f613c23e59db99324d
- MD5 f100438ac68ae3c1f7d091dd00d4840d
- SHA1 1a9556b531c26422e5b6d44365e567d585593f40
- SHA512 31f19a2452f9ef7e1259a21b40e09bb083bee730448ec33e54865b72f21ba37c04e420f8b866e9739c3c90d7c2cbfd7431ee3162f911b55e12172b3d8ebf9637
- TLSH T181514A1722E84619F6F3BB40E6B90A720B367C96AD3CD94C49D10D4E48E0E409873BFB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6FDC.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\@AE3E3.tmp.exe
- Size 1.8MB
- SHA256 74484f734999800f3d5834f1f581b0484212ff7adc491b3904cc3cf2a8e9a0bd
- MD5 106b655abfd407edf6fd2a225dbca76a
- SHA1 1d29a7ada77033c4fdeb0e086f9361eb8efffa0d
- SHA512 3fec6d6ffa8ff81f25b659f22c345046cb733ce897ee12d44e8169b28ba1fa5acedc1d58a508c99673d4198dbf6008718d6718bf5f90e71721296b174d876efe
- SSDEEP 24576:gzdVtTj2i6bJ5QT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaopV:sbTCHBxKCnFnQXBbrtgb/iQvu0UHOE
- TLSH T1978501152390CD61F76FC07283E56E79B6B329213733D89A6F4855312BF2E2EE781096
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp1440.tmp
- Size 229KB
- SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
- MD5 6f90e1169d19dfde14d6f753f06c862b
- SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
- SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp146F.tmp
- Size 120KB
- SHA256 01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a
- MD5 f558c76b0376af9273717fa24d99ebbf
- SHA1 f84bcece5c6138b62ef94e9d668cf26178ee14cc
- SHA512 2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp1490.tmp
- Size 126KB
- SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
- MD5 02ae22335713a8f6d6adf80bf418202b
- SHA1 4c40c11f43df761b92a5745f85a799db7b389215
- SHA512 727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp14C0.tmp
- Size 89KB
- SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
- MD5 09203a9741b91f3a9ed01c82dcb8778d
- SHA1 13e6f3fb169cd6aa5e4d450417a7e15665a2e140
- SHA512 9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp14E0.tmp
- Size 99KB
- SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
- MD5 9a27bfb55dd768ae81ca8716db2da343
- SHA1 55da0f4282bd838f72f435a5d4d24ac15b04482b
- SHA512 d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp1500.tmp
- Size 172KB
- SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
- MD5 2634fa3a332c297711cb59d43f54ffce
- SHA1 8e2b68d0ee4e792efb1945ba86eceb87f07087d2
- SHA512 84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp1520.tmp
- Size 276KB
- SHA256 d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc
- MD5 e07c6a9e595f045fadc463dfda44ab16
- SHA1 e6b199272ade02613f2003c365a4cb1487431e23
- SHA512 f3c630ae8381b99519aeeadbc2918810e7fb09a909f73ee6c46f4e9d3cf8c5051a5cf763db6a775d6cd8713ccf95a63b18df9ed756fa28276e8d7ab6a47f2cbf
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX:T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 b9f49b2aefc59adf57fb08d090cb11623d8c46092614923d14a542ed6383d745
- MD5 12e9053cb7116c4fc0c173d34437c83c
- SHA1 05142136bd33c1fa4f9721786b9c21a7edb3ca94
- SHA512 a8fa4e006e886000a7437268dad6d3c242cbc7cfb2e1d9b543f5f0d1788876b242a9ab623ffb5711757dd751e961904842944c8793dd9473ef233cd8c1e98c72
- SSDEEP 24576:gzdVtTj2i6bJ5QT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaopP:sbTCHBxKCnFnQXBbrtgb/iQvu0UHOg
- TLSH T1D48501152390CD61F76FC07283E56E79B6B329213733D89A6F4855312BF2E2EE781096
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 194B
- SHA256 f2fcbfd01510a8fac0a926355e7e5ed394f068dd9521085ba0e999947a2a835f
- MD5 ed04d3bab9df2aeeac87552e64ee1715
- SHA1 bf51ca1dbdf63dde35e1e8af91a2eee284aca97c
- SHA512 4679d3ce64664deb12f3a0f2ad9631790254efc1ad0dbc011bf877d02ae81a37d110adf334d75239f98a581f2d7509ad655d85b87d0f0edceaf8d3c042c1ffa1
- TLSH T179C0120742C6C79D684460570B75519DD1B84AE93F89771AC612C45C21C151DBD93601
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 ae58c8a6f01ecfed7d07fed8577f824447e8759d04b481d6925f3e99acea90d1
- MD5 52ca1044859b93365681e287e076e483
- SHA1 bf4bfe2e06125cd4629c20c2794e77481da206d1
- SHA512 2fa1df9d5e7f84acc9a08b167ed6dfa1d7a9978cca564a09664ad49726380056952a60cb92805025c3a64bfcfb6d5d284141fbc17c873edd619211e4fe5abdd6
- TLSH T103B09B1603D9DB4E745260570779556D507C4EC23E947605C611849C3145D0DFC56545
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 397KB
- SHA256 46531fdcb25851c1cc9aabd320aea1925b459a3106040d1c37334b97980aaec2
- MD5 dfd79ed7a3e608aa717743f9e75c4613
- SHA1 1e9ab2729d2da8e3fe5116a833d089cd517b17ac
- SHA512 c08bf246451a32c708808fb5a870629d732581c35da0333600e74d00dae5a05dc7d9978fefb1fc34f7c099b0ee9bb9155756ff16b82a9826c90635dbbf973f80
- SSDEEP 6144:AeDT2zbyLpoFDpyfaMUqbcQ2uAOwe0Yg1ATPcdUoJFfAaaNzxOPMVP1tQ+jBSK4+:AeDCysQ2uWoFNgdo4+
- TLSH T165843A03EAA890A1E9F74B70296EA22A503DB8754F50DDDF726447EDA430EC18F75B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 dbbacd5232cc575b7cb1a898545b3e8ccc9cd6fd554a9d8326ac7a5ee1c1a724
- MD5 d45b68ae4fa4fd3db1a2bb802f904983
- SHA1 74e202ec9954f19be614f5d0ada2f5d6d3308fcf
- SHA512 dc2e068d69509b9a81efbbf49b16f20f3daeda3fd58314d4e238d88c877a37957b08b6c9530758a315e918802086e21842049b1f2cbc1cd7731e1428ab49ecbe
- TLSH T180D05E0E4BDD11BDE052002F31B8D4C27239AF11D8720F4C5039674164287D9BFBE2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH