Overview
overview
10Static
static
102026-05-29...er.exe
windows10-2004-x64
92026-05-29...er.exe
windows11-21h2-x64
9$PLUGINSDI...ol.dll
windows10-2004-x64
9$PLUGINSDI...ol.dll
windows11-21h2-x64
9$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows11-21h2-x64
3$PLUGINSDI...te.ps1
windows10-2004-x64
3$PLUGINSDI...te.ps1
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 01:01
Behavioral task
behavioral1
Sample
2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Processes.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/RemoveSelfSignedCertificate.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/RemoveSelfSignedCertificate.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe
- Size 529KB
- Sample260529-bc8rasfs7n
- SHA256 124c592b500d7e89c23ca29e08cca6d49d063b53f62dcb3211c715ae1bbb763c
- MD5 489a2039d7b72df19aa1ee7d5ef27dc6
- SHA1 5106488bbf5278c9f7affaeeb1e772d37ea3bdaa
- SHA512 930a83c81ed87f7ef90651f55299c529a6e82b41624e07c892acea76a662859e71d94a5db7ef6bbdffb7d1167acf03c7051f8b4d8cb7f0795a53e95b90ed9bec
- SSDEEP 12288:RW2DnioX4iBX2+kwFX47D4WChtt4NTrh93oWnI7wtBc:pDnNl5IVTRPc
- TLSH T1FBB44A02F7D08E36E5B29A76D9B7569A4735BD42AF22535F6304F60C38F2600DEB1329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/files/0x00080000000245f3-3.dat UPX behavioral1/memory/2676-243-0x0000000073DB0000-0x0000000073DBB000-memory.dmp UPX - Stops running service(s) 4 TTPs
- Deletes itself 1 IoCs
pid Process 2676 Un_A.exe - Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 2484 tasklist.exe 3820 tasklist.exe 4536 tasklist.exe -
resource yara_rule behavioral1/memory/2676-243-0x0000000073DB0000-0x0000000073DBB000-memory.dmp upx - Executes dropped EXE 1 IoCs
pid Process 2676 Un_A.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4136 sc.exe 1484 sc.exe - Loads dropped DLL 64 IoCs
pid Process 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe -
pid Process 4640 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Un_A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Kills process with taskkill 27 IoCs
pid Process 3284 taskkill.exe 3284 taskkill.exe 1924 taskkill.exe 2000 taskkill.exe 4464 taskkill.exe 2608 taskkill.exe 3872 taskkill.exe 2480 taskkill.exe 4448 taskkill.exe 4284 taskkill.exe 964 taskkill.exe 1084 taskkill.exe 2852 taskkill.exe 4084 taskkill.exe 544 taskkill.exe 4136 taskkill.exe 3188 taskkill.exe 4748 taskkill.exe 2616 taskkill.exe 2984 taskkill.exe 4144 taskkill.exe 2688 taskkill.exe 3312 taskkill.exe 2580 taskkill.exe 4720 taskkill.exe 3880 taskkill.exe 2336 taskkill.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 2676 Un_A.exe 4640 powershell.exe 4640 powershell.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 4144 taskkill.exe Token: SeDebugPrivilege 2484 tasklist.exe Token: SeDebugPrivilege 2480 taskkill.exe Token: SeDebugPrivilege 3820 tasklist.exe Token: SeDebugPrivilege 3284 taskkill.exe Token: SeDebugPrivilege 4536 tasklist.exe Token: SeDebugPrivilege 2688 taskkill.exe Token: SeDebugPrivilege 1924 taskkill.exe Token: SeDebugPrivilege 3312 taskkill.exe Token: SeDebugPrivilege 2580 taskkill.exe Token: SeDebugPrivilege 4448 taskkill.exe Token: SeDebugPrivilege 4084 taskkill.exe Token: SeDebugPrivilege 4284 taskkill.exe Token: SeDebugPrivilege 4720 taskkill.exe Token: SeDebugPrivilege 3880 taskkill.exe Token: SeDebugPrivilege 964 taskkill.exe Token: SeDebugPrivilege 544 taskkill.exe Token: SeDebugPrivilege 2000 taskkill.exe Token: SeDebugPrivilege 4136 taskkill.exe Token: SeDebugPrivilege 3188 taskkill.exe Token: SeDebugPrivilege 4464 taskkill.exe Token: SeDebugPrivilege 2336 taskkill.exe Token: SeDebugPrivilege 3284 taskkill.exe Token: SeDebugPrivilege 2608 taskkill.exe Token: SeDebugPrivilege 1084 taskkill.exe Token: SeDebugPrivilege 4748 taskkill.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 2852 taskkill.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeDebugPrivilege 3872 taskkill.exe Token: SeDebugPrivilege 4640 powershell.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2676 1712 2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe 87 PID 2676 wrote to memory of 4144 2676 Un_A.exe 99 PID 2676 wrote to memory of 748 2676 Un_A.exe 101 PID 748 wrote to memory of 2484 748 cmd.exe 103 PID 748 wrote to memory of 3356 748 cmd.exe 104 PID 2676 wrote to memory of 2480 2676 Un_A.exe 105 PID 2676 wrote to memory of 4124 2676 Un_A.exe 107 PID 4124 wrote to memory of 3820 4124 cmd.exe 109 PID 4124 wrote to memory of 4448 4124 cmd.exe 110 PID 2676 wrote to memory of 3284 2676 Un_A.exe 111 PID 2676 wrote to memory of 2128 2676 Un_A.exe 113 PID 2128 wrote to memory of 4536 2128 cmd.exe 115 PID 2128 wrote to memory of 4624 2128 cmd.exe 116 PID 2676 wrote to memory of 2688 2676 Un_A.exe 117 PID 2676 wrote to memory of 1924 2676 Un_A.exe 119 PID 2676 wrote to memory of 3312 2676 Un_A.exe 121 PID 2676 wrote to memory of 2580 2676 Un_A.exe 123 PID 2676 wrote to memory of 4448 2676 Un_A.exe 125 PID 2676 wrote to memory of 4084 2676 Un_A.exe 127 PID 2676 wrote to memory of 4284 2676 Un_A.exe 129 PID 2676 wrote to memory of 4720 2676 Un_A.exe 131 PID 2676 wrote to memory of 3880 2676 Un_A.exe 133 PID 2676 wrote to memory of 964 2676 Un_A.exe 135 PID 2676 wrote to memory of 544 2676 Un_A.exe 137 PID 2676 wrote to memory of 2000 2676 Un_A.exe 139 PID 2676 wrote to memory of 4136 2676 Un_A.exe 141 PID 2676 wrote to memory of 3188 2676 Un_A.exe 144 PID 2676 wrote to memory of 4464 2676 Un_A.exe 146 PID 2676 wrote to memory of 2336 2676 Un_A.exe 149 PID 2676 wrote to memory of 3284 2676 Un_A.exe 151 PID 2676 wrote to memory of 2608 2676 Un_A.exe 154 PID 2676 wrote to memory of 1084 2676 Un_A.exe 156 PID 2676 wrote to memory of 4748 2676 Un_A.exe 158 PID 2676 wrote to memory of 2616 2676 Un_A.exe 160 PID 2676 wrote to memory of 2852 2676 Un_A.exe 162 PID 2676 wrote to memory of 2984 2676 Un_A.exe 164 PID 2676 wrote to memory of 3872 2676 Un_A.exe 166 PID 2676 wrote to memory of 4136 2676 Un_A.exe 168 PID 2676 wrote to memory of 1484 2676 Un_A.exe 170 PID 2676 wrote to memory of 4640 2676 Un_A.exe 172 PID 2676 wrote to memory of 688 2676 Un_A.exe 174 PID 2676 wrote to memory of 4488 2676 Un_A.exe 175 PID 2676 wrote to memory of 4176 2676 Un_A.exe 176
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /im "SteelSeriesGGEZ.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe" | find /i "SteelSeriesGGEZ.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\tasklist.exetasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Windows\SysWOW64\find.exefind /i "SteelSeriesGGEZ.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3356
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /im "SteelSeriesGG.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /nh /fi "imagename eq SteelSeriesGG.exe" | find /i "SteelSeriesGG.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\tasklist.exetasklist /nh /fi "imagename eq SteelSeriesGG.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SysWOW64\find.exefind /i "SteelSeriesGG.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4448
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /im "SteelSeriesGGMain.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /nh /fi "imagename eq SteelSeriesGGMain.exe" | find /i "SteelSeriesGGMain.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\tasklist.exetasklist /nh /fi "imagename eq SteelSeriesGGMain.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\SysWOW64\find.exefind /i "SteelSeriesGGMain.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4624
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGGEZ.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGG.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGGMain.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine3.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGGClient.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine3Client.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SSOverlay.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM gamesense-discord-x64.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AudioSync.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM now-playing.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesSystemMonitorLauncher.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM runStatsElevated.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3188
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesCaptureSvc.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesMoments.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM moments.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesCVGameSense.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesSonar.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesPrism.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesPrismSync.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeries3DATLauncher.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 3dat.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesSensitivityFinder.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\SysWOW64\sc.exesc stop SteelSeriesGGUpdateServiceProxy3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4136
-
-
C:\Windows\SysWOW64\sc.exesc delete SteelSeriesGGUpdateServiceProxy3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1484
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\RemoveSelfSignedCertificate.ps1" -Thumbprint ""3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\apps\engine\AudioDeviceFXPluginAPI.x64.dll"3⤵PID:688
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\apps\engine\AudioDeviceManagerAPI.x64.dll"3⤵PID:4488
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\apps\engine\SSAudioNineEarsAPI.x64.dll"3⤵PID:4176
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2bt0aqu.hva.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\ExecDos.dll
- Size 18KB
- SHA256 d61a8d29ff9965c48d7a59cc6d97a21044721ead839613156f9ac768e93450c7
- MD5 a62969695859e1aa4a9c3b3dbb2e1e1c
- SHA1 563822d6ae1df66791dd6eeead1771ae8c123a0f
- SHA512 f6ce54afe5d58ab382f3bfc6eb59311b4c4001c1da35da3a133c6933f95f8e2d04f080a04833035a682ae12157f5ac6a9db3e2c7e35812981e36ae21615788b4
- SSDEEP 384:RCqAUtwYjH1cEXhVHQIYizr3a5Uz6RcCSJIVE8E9VF0NyPR:RFcIFhZ5YizTa6zsc2Er
- TLSH T133826C7286A01C13CD7B4E3039D0963BAFB5B9524E50C5E7521AC5C54B90B82FFA92BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\LangDLL.dll
- Size 5KB
- SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
- MD5 014a3be4a7c1ccb217916dbf4f222bd1
- SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
- SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
- SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
- TLSH T143C19470F3C248B9C491413368E737D36612EE746784500F9B6311AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\Processes.dll
- Size 61KB
- SHA256 5f0c517734dfdcd5ea26088d59dcce8dbe5bc625a0027cbd1846566c9a52b447
- MD5 8bc9dda307f248388d361771eb83fd49
- SHA1 af1b7ec663ace0d4a120f1e7006afa4c52ba403a
- SHA512 27e4daabffdcd9e0a9f58600b8b30a7c5322dd936d15ddb2a07a55fc51ef53d0d40a62cd7542acedc24745ad18f1c6498ea7c623903f093e0d6dd282d7b2c77b
- SSDEEP 1536:5xKHTc7duewxwUMtLk/4HIPRksvGILb7zTaZiN:8IduTWnI5vGAHTIu
- TLSH T1C3536C12A350C436E15B593064E8C2725E7E7C226AF494CB7B9903B95FB03D0FA793B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\RemoveSelfSignedCertificate.ps1
- Size 1KB
- SHA256 5ee93c360e91f4753026d47e2e8cf3e7b2bc306e9992fccb88b56fb3e7c718fb
- MD5 317869d5d52e8de74062662898851f4d
- SHA1 c8167809f3652809ebeb984f8c1418e15bde0a98
- SHA512 42b92401c7e5275444cbaa0bcec9e28fa4735ef573d71e3371082156153ab003ece6365e92336b9e6a88f9166cad87354de4882a0acf055573b9e17df9a29627
- TLSH T151217D1422C2A9702FB163A6D503848AF957807B83767D41B1DE80DC5B23C3BD7E855A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2372.tmp\nsExec.dll
- Size 7KB
- SHA256 5e66489393f159aa0fd30b630bb345d03418e9324e7d834b2e4195865a637cfe
- MD5 4c77a65bb121bb7f2910c1fa3cb38337
- SHA1 94531e3c6255125c1a85653174737d275bc35838
- SHA512 df50eadf312469c56996c67007d31b85d00e91a4f40355e786536fc0336ac9c2fd8ad9df6e65ab390cc6f031aca28c92212ea23cc40eb600b82a63be3b5b8c04
- SSDEEP 96:JXmkmwmHDqaRrlfAF4IUIqhmKv6vBckXK9wSBl8gvElHturnNQaSGYuHr2DCP:JAjRrlfA6Nv6eWIElNurnNQZGdHc
- TLSH T190E14A3535C03DF7D08D48707C1A2E1B93F0C9321BBA01A08A6B19D576E2AE7F938742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
- Size 529KB
- SHA256 124c592b500d7e89c23ca29e08cca6d49d063b53f62dcb3211c715ae1bbb763c
- MD5 489a2039d7b72df19aa1ee7d5ef27dc6
- SHA1 5106488bbf5278c9f7affaeeb1e772d37ea3bdaa
- SHA512 930a83c81ed87f7ef90651f55299c529a6e82b41624e07c892acea76a662859e71d94a5db7ef6bbdffb7d1167acf03c7051f8b4d8cb7f0795a53e95b90ed9bec
- SSDEEP 12288:RW2DnioX4iBX2+kwFX47D4WChtt4NTrh93oWnI7wtBc:pDnNl5IVTRPc
- TLSH T1FBB44A02F7D08E36E5B29A76D9B7569A4735BD42AF22535F6304F60C38F2600DEB1329
- MD5 SHA1 SHA512 SSDEEP TLSH