f6045a6873815ffa7805c144d4e3b0541fa67f5b91e9833985cff213ba27a701

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Size 18.6MB
Sample260505-mt968sc12v
SHA256 f6045a6873815ffa7805c144d4e3b0541fa67f5b91e9833985cff213ba27a701
MD5 2c5c9a6ed65062d754c581084a4ef74f
SHA1 2021be6cc9c74ead347df807cb808a4448be5fac
SHA512 29991f8b774d3e128b095adfece3ee86bcd822eee9e9c85fe9e87c3d19717e2d075ad9f7d430564d43504b56787e67dba8a9be4664bf24040a9aa0d57024e722
SSDEEP 393216:l7BZaEqtNZcdmThdq2W0rkbasOHTVsCA6SULD:nZLdQhdgiH9Ay
TLSH
T1D0171233BD479472E493023145ADB77E1FBDBE26272880D392C13A2569B12C15F3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware bootkit defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1500	netsh.exe
2516	netsh.exe
4432	netsh.exe
1792	netsh.exe
568	netsh.exe
2336	netsh.exe
2172	netsh.exe
1308	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1136	easysoft.exe
2452	MiniThunderPlatform.exe

Loads dropped DLL 11 IoCs

pid	Process
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe
2452	MiniThunderPlatform.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
File opened (read-only)	\??\D:	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MiniThunderPlatform.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Easysoft\log.ini	easysoft.exe
File created	C:\Program Files (x86)\Easysoft\easysoft.exe	easysoft.exe
File opened for modification	C:\Program Files (x86)\Easysoft\easysoft.exe	easysoft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	easysoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MiniThunderPlatform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\tjloader.klmsdn.com	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\tjloader.klmsdn.com\ = "63"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\klmsdn.com\Total = "63"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\klmsdn.com	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\DOMStorage\klmsdn.com\NumberOfSubdomains = "1"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Token: SeRestorePrivilege	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Token: SeTakeOwnershipPrivilege	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Token: SeSecurityPrivilege	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Token: SeManageVolumePrivilege	2452	MiniThunderPlatform.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
1136	easysoft.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1136	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	79
PID 4588 wrote to memory of 3396	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	81
PID 3396 wrote to memory of 2516	3396	cmd.exe	83
PID 4588 wrote to memory of 5096	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	84
PID 5096 wrote to memory of 4432	5096	cmd.exe	86
PID 4588 wrote to memory of 3148	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	87
PID 3148 wrote to memory of 1792	3148	cmd.exe	89
PID 4588 wrote to memory of 2220	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	90
PID 2220 wrote to memory of 568	2220	cmd.exe	92
PID 4588 wrote to memory of 1052	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	93
PID 1052 wrote to memory of 2336	1052	cmd.exe	95
PID 4588 wrote to memory of 2820	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	96
PID 2820 wrote to memory of 2172	2820	cmd.exe	98
PID 4588 wrote to memory of 2264	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	99
PID 2264 wrote to memory of 1308	2264	cmd.exe	101
PID 4588 wrote to memory of 2680	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	102
PID 2680 wrote to memory of 1500	2680	cmd.exe	104
PID 4588 wrote to memory of 2452	4588	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe	105

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_2c5c9a6ed65062d754c581084a4ef74f_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4588
- C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\easysoft.exe
  C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\easysoft.exe /oobesp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall delete rule name = "桌面调用工具"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name = "桌面调用工具"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\tools\aria2c.exe" action=allow
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\tools\aria2c.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\tools\aria2c.exe" action=allow protocol=tcp profile=public
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\tools\aria2c.exe" action=allow protocol=tcp profile=public
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\tools\aria2c.exe" action=allow protocol=udp profile=public
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\tools\aria2c.exe" action=allow protocol=udp profile=public
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall delete rule name = "桌面调用工具"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name = "桌面调用工具"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2336
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" action=allow
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" action=allow protocol=tcp profile=public
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" action=allow protocol=tcp profile=public
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  cmd /C netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" action=allow protocol=udp profile=public
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name = "桌面调用工具" dir=in program = "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" action=allow protocol=udp profile=public
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1500
- C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe
  "C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe" -StartTP
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HWOVP12N.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4ZYCBON0\HWOVP12N.htm
Size 1KB
SHA256 f91b20a80e107cd586d47fee1e3c4806085acd8633ceeff1b583b6b376fff756
MD5 7a45ee1cc318db8a8e0b558b66b2d078
SHA1 54e59a49d529d28105bd9d4af3e315054859680b
SHA512 5b65b9486606d58629e718cab5c871b62c63f3a19afbf8ad031e8f89b6136e72e439d700ee82926fd4925a67c8813e05735fa212f0bef088bcb1bd356b7d6c83
TLSH
T14221231B0DF55114621144B84AF6AB487A777007C15EDD44BA9CD068DFC8FCA9C1B79C
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\7z.dll
Size 170KB
SHA256 b8521abda09ec17ddad36528c1bc50395dc8c5f7c11c026a5b3ff23110c54182
MD5 31cad6a3edd1c32981ad6b565cbeac94
SHA1 9338978c85a9423ee2a38cba027f79192d684f1b
SHA512 02e198b8ef192de55db35ae00a16a80b3309a9373a596c20d617b43dd7159a635bc303f371859e704375521a1242d02754807e2e9dfef63ffd06993b24c17d3d
SSDEEP 3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
TLSH
T1CA04AF11B6A6C4F4D34F2132D96A3FB663B9D2848F6548C37BA0DE6E2E329C1D53520D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MiniThunderPlatform.exe

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\MiniThunderPlatform.exe
Size 266KB
SHA256 f1a7a250356418e387d2827dd440b76326586621b4fdd837f8b327d16919827f
MD5 5761b0b1f4ba56ef156a8848d1c214cf
SHA1 bea7e9a95457ab67cda2e75757facdeaf88b3cff
SHA512 8a8da092149da09d222ad236ef0f15738d0474fd0016300dda0c8fbc7eb5200a9eb3f90e8944ee5f805717cff247475ec3e0f928e7839daaab71507d34dd4af9
SSDEEP 3072:YGNWHDzttk5pLzSMEjF47yctMYTWfYj9DfWxRmY7jyP0ejUl:dNmZtb4wNQBDfWxRvs0ewl
TLSH
T15444E811E7008176F6D742B26FEDA67855F8ACE04F8834FB71D98369113A3D16236BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLBugHandler.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\XLBugHandler.dll
Size 98KB
SHA256 1845df41da539bca264f59365bf7453b686b9098cc94cd0e2b9a20c74a561096
MD5 92154e720998acb6fa0f7bad63309470
SHA1 385817793b9f894ca3dd3bac20b269652df6cbc6
SHA512 37ba81f338af7de7ef2ac6bcf67b3aec96f9b748830ee3c0b152029871f7701e917b94a6b51acd7be6f8f02aea2b25f3b14ced1a218bf4868af04f5207bb5fff
SSDEEP 768:ptC/WRVyC4jjurmOgxhQgVQfWDwI8JefPffPbrwehZ/kUZ7lzajun:ptC/WG2Kq8wIwef3Z/7Z7Bvn
TLSH
T1CFA30927E68BC473E5EE1EBC62B5632253B5E4060BD533C302B0AD9E8DD63D27A31945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLBugReport.exe

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\XLBugReport.exe
Size 242KB
SHA256 64f8d68cc1cfc5b9cc182df3becf704af93d0f1cc93ee59dbf682c75b6d4ffc0
MD5 67c767470d0893c4a2e46be84c9afcbb
SHA1 00291089b13a93f82ee49a11156521f13ea605cd
SHA512 d5d3a96dec616b0ab0cd0586fa0cc5a10ba662e0d5e4de4d849ac62ca5d60ec133f54d109d1d130b5f99ae73e7abfb284ec7d5ba55dca1a4f354c6af73c00e35
SSDEEP 3072:XMdUQGp4lA6Ce3PVd0zA+NzWfhYxMyIxZ2D6YmxX7hNKQ+Gr3:Xl4lrHdcFzWJYxMVZ2D6YmxXdL+63
TLSH
T130345B2B3AE08772D067F5B149C2AF76A770FC301D22920BB244A74D5D789692D23B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atl71.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\atl71.dll
Size 87KB
SHA256 a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
MD5 79cb6457c81ada9eb7f2087ce799aaa7
SHA1 322ddde439d9254182f5945be8d97e9d897561ae
SHA512 eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
SSDEEP 1536:kIlL9T5Xx1ogKMvw5Br7KLKLI+Xe+QnyH4Cc0tR6nGVp/VTbkE0DJ4ZwmroV:BtvBOI+FQny5R6nG//SdaZwms
TLSH
T185934B13B3C5C1F5E7E20577C93DBB9253AEEA040B5991A313183A8E5DB26C7CA3C256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dl_peer_id.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\dl_peer_id.dll
Size 89KB
SHA256 69a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
MD5 dba9a19752b52943a0850a7e19ac600a
SHA1 3485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA512 a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
SSDEEP 1536:5myH1Ar4zLdIoXJED0ySFzyhSU+kcexDCaDRqxAnNQDB:foEZEDDSFzDkce7RqxAnIB
TLSH
T186935B023245F571E29809309F9C6781F7FAF4673DA4531BA2EE45CFAEF07858251AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download_engine.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\download_engine.dll
Size 3.4MB
SHA256 ce09928019dd63b7495c33f4e9cabd6d0f49b37afbc55b8072aa54d8fa92badc
MD5 f439fadefab179b17e5c209172276ce1
SHA1 f1e27afac4b1e28a8ea26c149bc929fb7ab68c7a
SHA512 a959da00d128dc638c5d1860851c534000be2d2bfd44b75a9d744709bdf9a55df9eb4ec3a322543d046ea0d37b63a28c5e8a99b1baca5691f31afadd56469177
SSDEEP 49152:hL6mW9dm3o/nviUBWEO2ivd6B5M/k7rOxWqu7w74PQqXztX:hWX/nnm2oi5r7r9+Ep
TLSH
T1BAF58E81F3E3C9B5C6CE06B40C3D6B6E56A96BA04B718AD372142B6F9D362D1D433346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.dat

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\id.dat
Size 40B
SHA256 c6233de5d227e53209c6fda197c77b23f32351db234c1c1069c3acb26686967f
MD5 9f9b4bc7adafe3333ed2a292044449b4
SHA1 f7f84f99d5b3c779e52005d7e88dae301e48704e
SHA512 dead6bde13f0fef8f7f87423843e1b7aa1962ba0f611b980ff0c782bf9b5cdc6248e117b7e844a77d30dabd1e1b3ab85d8d6725a28eeeffd1a99249d49487e5d
MD5 SHA1 SHA512

Submit Download

msvcp71.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\msvcp71.dll
Size 492KB
SHA256 6c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9
MD5 a94dc60a90efd7a35c36d971e3ee7470
SHA1 f936f612bc779e4ba067f77514b68c329180a380
SHA512 ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab
SSDEEP 12288:b692dAsfQqt4oJcRYRhUgiW6QR7t5k3Ooc8iHkC2ek:bSYACJcRYe3Ooc8iHkC2e
TLSH
T1FFB4D82377434AF1E092B3F576C6032297F5FC654A25B32392DFE4642FAA3895173A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr71.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\msvcr71.dll
Size 340KB
SHA256 c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
MD5 ca2f560921b7b8be1cf555a5a18d54c3
SHA1 432dbcf54b6f1142058b413a9d52668a2bde011d
SHA512 23e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e
SSDEEP 6144:cPlV59g81QWguohIP/siMbo8Crn2zzwRFMciFMNrb3YgxS3bCAO5kkG:OlVvN1QWguohInJDrn8zwNF7eCr
TLSH
T14674AF137293DCB2E0B2007A4D4A7B599BBFF430443A8933AFE40E5D4BB5BD19626653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\download\zlib1.dll
Size 58KB
SHA256 bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56
MD5 89f6488524eaa3e5a66c5f34f3b92405
SHA1 330f9f6da03ae96dfa77dd92aae9a294ead9c7f7
SHA512 cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e
SSDEEP 1536:ZfU1BgfZqvECHUhUMPZVmnToIfxIOjIOG8TI:ZfzfZR2UhUMPZVSTBfbFG6I
TLSH
T125438D4297D197A6E8F8263944D7AB2DE732B205476EC6E3A08C3F9558413E4E7312CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

easysoft.exe

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\easysoft.exe
Size 10.6MB
SHA256 b20355bfdf84ed92e9ef0b27c81811a679d91713fabd108045096793f3ef636b
MD5 c47ee2eab505eebf6224533764a149ef
SHA1 e9d378e99c1627bf36265bde14af570b63bda12d
SHA512 ed6f7d988a33f705961674c8edc4929ec59c6428452ab8d812641a5fce053adc3140846c718b8bf6704e83eb3e5b76093dcf2ace2b99eb3beadfb996509862f4
SSDEEP 196608:NHdRDiDNySDxCYZsUiw+dcZHISBVu7UVGzzNc082au+FLOyomFHKnP:w88C1cZHu1zz3EF
TLSH
T1FAB60221BD8A84B2D4530236D9ADB73E147DEE34172A40D793C03B196DB13D27A3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

encmsdnkloader

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\encmsdnkloader
Size 56KB
SHA256 12cda45cc72b18deba6988889d3fb6073bdd53d6d3073abd50660676c65bc33e
MD5 c937098f9a206b655aa3d817633778a6
SHA1 badf4dd4f75fa6c66d5ee2da85e71ba38b93cb3a
SHA512 cfb047f7e90c8f270d3a3939aa1450b0f41953d5e17d9e89fa8d9c18acfd99254e9267c21bf1f3f303dbbea72f98796e3207b6183ed0b17e809909fa67735426
SSDEEP 768:sJ8K+CYanh4vlVTd6pDYp5lGlntvvOPRuw8vU:LCDnqtVTd6pMpfL
TLSH
T15743C5D274B701C5FF8BB584502989926F85C8FF45BA464031D5EA4E3F3ECC5EB86A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xldl.dll

Path C:\Users\Admin\AppData\Local\Temp\Z8j1M5eYxi\xldl.dll
Size 286KB
SHA256 d0a7baaa3d861cf5d516e142006f844edeee2eecf834d2268e96e4162e1261d9
MD5 e0604fb53ce668bb093209e2300b1f27
SHA1 c80b30d9fc25a95d957a5f560402dff685f0fe8a
SHA512 c5ee41389f155dc5043353d0159753ad31549d7b17180c5030a53f229dac6f556261e60fa0feb99323f1b6fd9bf749a4d467b3250c37d21cd0360bc7b1135325
SSDEEP 6144:IP45TQNN/B3tCyDBR3PpC9X8CjIHM8DjzBY9d:IwgRWyD7/pSX8C8HM8Djzu
TLSH
T156548D12F69641B4EE8F1E7409BC675D6ABDAA4107E0CAC7E7942A5BD9373C0493308F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.cfg

Path C:\Users\Public\Thunder Network\Mini_downloadlib\ODAwMDAwNDM=\Version_3_2_1_46\Profiles\download.cfg
Size 286B
SHA256 c3fe997e00a2ab72bf78c221052a2973a3ebd02227d3beb50bc5ede4a75e4b27
MD5 20f8b2ef60b93cd7e50529f0e7b2a749
SHA1 6d6c2af413d2c654280756514cf4782bd038256c
SHA512 f797d9bd3a673cc4d22c59088c10e424420c443b147949c3d46040dc008750e73fdf29611d0713a43183feffb40c2581cc5ed5e2c1ea150042ff0e33d12f73a9
TLSH
T152D094763346C949DDE12F1872266E6BC05700BD413D8540A28E4C2BDE77DE12E9E343
MD5 SHA1 SHA512 TLSH

Submit Download

memory/568-2353-0x0000000000D60000-0x0000000000EAD000-memory.dmp

Download

memory/1136-51-0x00000000015F0000-0x000000000173D000-memory.dmp

Download

memory/1136-52-0x0000000002FA0000-0x0000000002FB2000-memory.dmp

Download

memory/1308-2356-0x0000000000C70000-0x0000000000DBD000-memory.dmp

Download

memory/1500-2357-0x0000000001800000-0x000000000194D000-memory.dmp

Download

memory/1792-2352-0x0000000001440000-0x000000000158D000-memory.dmp

Download

memory/2172-2355-0x00000000014A0000-0x00000000015ED000-memory.dmp

Download

memory/2336-2354-0x0000000001480000-0x00000000015CD000-memory.dmp

Download

memory/2452-2433-0x000000000CC20000-0x000000000CC32000-memory.dmp

Download

memory/2452-2376-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/2452-2381-0x00000000028B0000-0x0000000002C10000-memory.dmp

Download

memory/2452-2431-0x0000000002320000-0x000000000233A000-memory.dmp

Download

memory/2452-2430-0x0000000000870000-0x00000000009BD000-memory.dmp

Download

memory/2452-2391-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2452-2432-0x00000000027C0000-0x00000000028AA000-memory.dmp

Download

memory/2516-2350-0x0000000001480000-0x00000000015CD000-memory.dmp

Download

memory/4432-2351-0x0000000001580000-0x00000000016CD000-memory.dmp

Download

memory/4588-2428-0x0000000001E10000-0x0000000001F5D000-memory.dmp

Download

memory/4588-53-0x0000000001E10000-0x0000000001F5D000-memory.dmp

Download