Overview
overview
10Static
static
102026-05-29...er.exe
windows10-2004-x64
92026-05-29...er.exe
windows11-21h2-x64
9$PLUGINSDI...ol.dll
windows10-2004-x64
9$PLUGINSDI...ol.dll
windows11-21h2-x64
9$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows11-21h2-x64
3$PLUGINSDI...te.ps1
windows10-2004-x64
3$PLUGINSDI...te.ps1
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 01:01
Behavioral task
behavioral1
Sample
2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Processes.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/RemoveSelfSignedCertificate.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/RemoveSelfSignedCertificate.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe
- Size 529KB
- Sample260529-bc8rasfs7n
- SHA256 124c592b500d7e89c23ca29e08cca6d49d063b53f62dcb3211c715ae1bbb763c
- MD5 489a2039d7b72df19aa1ee7d5ef27dc6
- SHA1 5106488bbf5278c9f7affaeeb1e772d37ea3bdaa
- SHA512 930a83c81ed87f7ef90651f55299c529a6e82b41624e07c892acea76a662859e71d94a5db7ef6bbdffb7d1167acf03c7051f8b4d8cb7f0795a53e95b90ed9bec
- SSDEEP 12288:RW2DnioX4iBX2+kwFX47D4WChtt4NTrh93oWnI7wtBc:pDnNl5IVTRPc
- TLSH T1FBB44A02F7D08E36E5B29A76D9B7569A4735BD42AF22535F6304F60C38F2600DEB1329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x002000000002b40f-4.dat UPX behavioral2/memory/2044-242-0x0000000073B30000-0x0000000073B3B000-memory.dmp UPX - Stops running service(s) 4 TTPs
- Deletes itself 1 IoCs
pid Process 2044 Un_A.exe - Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 232 tasklist.exe 1692 tasklist.exe 2156 tasklist.exe -
resource yara_rule behavioral2/memory/2044-242-0x0000000073B30000-0x0000000073B3B000-memory.dmp upx - Executes dropped EXE 1 IoCs
pid Process 2044 Un_A.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4600 sc.exe 1812 sc.exe - Loads dropped DLL 64 IoCs
pid Process 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe -
pid Process 3140 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Un_A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Kills process with taskkill 27 IoCs
pid Process 4916 taskkill.exe 3988 taskkill.exe 496 taskkill.exe 4984 taskkill.exe 3600 taskkill.exe 2060 taskkill.exe 792 taskkill.exe 2396 taskkill.exe 3468 taskkill.exe 1692 taskkill.exe 3988 taskkill.exe 2540 taskkill.exe 4600 taskkill.exe 3992 taskkill.exe 5064 taskkill.exe 1460 taskkill.exe 1688 taskkill.exe 2128 taskkill.exe 1920 taskkill.exe 4628 taskkill.exe 4328 taskkill.exe 2184 taskkill.exe 4112 taskkill.exe 1288 taskkill.exe 2504 taskkill.exe 4280 taskkill.exe 2572 taskkill.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 2044 Un_A.exe 3140 powershell.exe 3140 powershell.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3988 taskkill.exe Token: SeDebugPrivilege 2156 tasklist.exe Token: SeDebugPrivilege 792 taskkill.exe Token: SeDebugPrivilege 1692 tasklist.exe Token: SeDebugPrivilege 2060 taskkill.exe Token: SeDebugPrivilege 232 tasklist.exe Token: SeDebugPrivilege 3600 taskkill.exe Token: SeDebugPrivilege 2540 taskkill.exe Token: SeDebugPrivilege 4984 taskkill.exe Token: SeDebugPrivilege 1920 taskkill.exe Token: SeDebugPrivilege 4600 taskkill.exe Token: SeDebugPrivilege 496 taskkill.exe Token: SeDebugPrivilege 4280 taskkill.exe Token: SeDebugPrivilege 2504 taskkill.exe Token: SeDebugPrivilege 2128 taskkill.exe Token: SeDebugPrivilege 3988 taskkill.exe Token: SeDebugPrivilege 1688 taskkill.exe Token: SeDebugPrivilege 1460 taskkill.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeDebugPrivilege 1288 taskkill.exe Token: SeDebugPrivilege 4916 taskkill.exe Token: SeDebugPrivilege 4112 taskkill.exe Token: SeDebugPrivilege 2396 taskkill.exe Token: SeDebugPrivilege 2572 taskkill.exe Token: SeDebugPrivilege 5064 taskkill.exe Token: SeDebugPrivilege 2184 taskkill.exe Token: SeDebugPrivilege 3992 taskkill.exe Token: SeDebugPrivilege 4328 taskkill.exe Token: SeDebugPrivilege 3468 taskkill.exe Token: SeDebugPrivilege 4628 taskkill.exe Token: SeDebugPrivilege 3140 powershell.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3152 wrote to memory of 2044 3152 2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe 81 PID 2044 wrote to memory of 3988 2044 Un_A.exe 120 PID 2044 wrote to memory of 3628 2044 Un_A.exe 86 PID 3628 wrote to memory of 2156 3628 cmd.exe 88 PID 3628 wrote to memory of 4484 3628 cmd.exe 89 PID 2044 wrote to memory of 792 2044 Un_A.exe 90 PID 2044 wrote to memory of 2896 2044 Un_A.exe 92 PID 2896 wrote to memory of 1692 2896 cmd.exe 94 PID 2896 wrote to memory of 364 2896 cmd.exe 127 PID 2044 wrote to memory of 2060 2044 Un_A.exe 96 PID 2044 wrote to memory of 2208 2044 Un_A.exe 98 PID 2208 wrote to memory of 232 2208 cmd.exe 100 PID 2208 wrote to memory of 244 2208 cmd.exe 101 PID 2044 wrote to memory of 3600 2044 Un_A.exe 102 PID 2044 wrote to memory of 2540 2044 Un_A.exe 104 PID 2044 wrote to memory of 4984 2044 Un_A.exe 106 PID 2044 wrote to memory of 1920 2044 Un_A.exe 149 PID 2044 wrote to memory of 4600 2044 Un_A.exe 150 PID 2044 wrote to memory of 496 2044 Un_A.exe 112 PID 2044 wrote to memory of 4280 2044 Un_A.exe 114 PID 2044 wrote to memory of 2504 2044 Un_A.exe 116 PID 2044 wrote to memory of 2128 2044 Un_A.exe 118 PID 2044 wrote to memory of 3988 2044 Un_A.exe 120 PID 2044 wrote to memory of 1688 2044 Un_A.exe 122 PID 2044 wrote to memory of 1460 2044 Un_A.exe 124 PID 2044 wrote to memory of 1692 2044 Un_A.exe 94 PID 2044 wrote to memory of 1288 2044 Un_A.exe 128 PID 2044 wrote to memory of 4916 2044 Un_A.exe 130 PID 2044 wrote to memory of 4112 2044 Un_A.exe 132 PID 2044 wrote to memory of 2396 2044 Un_A.exe 134 PID 2044 wrote to memory of 2572 2044 Un_A.exe 136 PID 2044 wrote to memory of 5064 2044 Un_A.exe 138 PID 2044 wrote to memory of 2184 2044 Un_A.exe 140 PID 2044 wrote to memory of 3992 2044 Un_A.exe 142 PID 2044 wrote to memory of 4328 2044 Un_A.exe 144 PID 2044 wrote to memory of 3468 2044 Un_A.exe 146 PID 2044 wrote to memory of 4628 2044 Un_A.exe 148 PID 2044 wrote to memory of 4600 2044 Un_A.exe 150 PID 2044 wrote to memory of 1812 2044 Un_A.exe 152 PID 2044 wrote to memory of 3140 2044 Un_A.exe 154 PID 2044 wrote to memory of 676 2044 Un_A.exe 156 PID 2044 wrote to memory of 4260 2044 Un_A.exe 157 PID 2044 wrote to memory of 1500 2044 Un_A.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_489a2039d7b72df19aa1ee7d5ef27dc6_amadey_cloudeye_coinminer_elex_hijackloader_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /im "SteelSeriesGGEZ.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe" | find /i "SteelSeriesGGEZ.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\tasklist.exetasklist /nh /fi "imagename eq SteelSeriesGGEZ.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\SysWOW64\find.exefind /i "SteelSeriesGGEZ.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4484
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /im "SteelSeriesGG.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /nh /fi "imagename eq SteelSeriesGG.exe" | find /i "SteelSeriesGG.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\tasklist.exetasklist /nh /fi "imagename eq SteelSeriesGG.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\SysWOW64\find.exefind /i "SteelSeriesGG.exe"4⤵
- System Location Discovery: System Language Discovery
PID:364
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /im "SteelSeriesGGMain.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /nh /fi "imagename eq SteelSeriesGGMain.exe" | find /i "SteelSeriesGGMain.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\tasklist.exetasklist /nh /fi "imagename eq SteelSeriesGGMain.exe"4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:232
-
-
C:\Windows\SysWOW64\find.exefind /i "SteelSeriesGGMain.exe"4⤵
- System Location Discovery: System Language Discovery
PID:244
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGGEZ.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGG.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGGMain.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine3.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesGGClient.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:496
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine3Client.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SSOverlay.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesEngine.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM gamesense-discord-x64.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AudioSync.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM now-playing.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesSystemMonitorLauncher.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:364
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM runStatsElevated.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesCaptureSvc.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesMoments.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM moments.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesCVGameSense.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesSonar.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesPrism.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesPrismSync.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeries3DATLauncher.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 3dat.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SteelSeriesSensitivityFinder.exe /T /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4628 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1920
-
-
-
C:\Windows\SysWOW64\sc.exesc stop SteelSeriesGGUpdateServiceProxy3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4600
-
-
C:\Windows\SysWOW64\sc.exesc delete SteelSeriesGGUpdateServiceProxy3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1812
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\RemoveSelfSignedCertificate.ps1" -Thumbprint ""3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\apps\engine\AudioDeviceFXPluginAPI.x64.dll"3⤵PID:676
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\apps\engine\AudioDeviceManagerAPI.x64.dll"3⤵PID:4260
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\apps\engine\SSAudioNineEarsAPI.x64.dll"3⤵PID:1500
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xu4whekx.b1k.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\ExecDos.dll
- Size 18KB
- SHA256 d61a8d29ff9965c48d7a59cc6d97a21044721ead839613156f9ac768e93450c7
- MD5 a62969695859e1aa4a9c3b3dbb2e1e1c
- SHA1 563822d6ae1df66791dd6eeead1771ae8c123a0f
- SHA512 f6ce54afe5d58ab382f3bfc6eb59311b4c4001c1da35da3a133c6933f95f8e2d04f080a04833035a682ae12157f5ac6a9db3e2c7e35812981e36ae21615788b4
- SSDEEP 384:RCqAUtwYjH1cEXhVHQIYizr3a5Uz6RcCSJIVE8E9VF0NyPR:RFcIFhZ5YizTa6zsc2Er
- TLSH T133826C7286A01C13CD7B4E3039D0963BAFB5B9524E50C5E7521AC5C54B90B82FFA92BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\LangDLL.dll
- Size 5KB
- SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
- MD5 014a3be4a7c1ccb217916dbf4f222bd1
- SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
- SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
- SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
- TLSH T143C19470F3C248B9C491413368E737D36612EE746784500F9B6311AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\Processes.dll
- Size 61KB
- SHA256 5f0c517734dfdcd5ea26088d59dcce8dbe5bc625a0027cbd1846566c9a52b447
- MD5 8bc9dda307f248388d361771eb83fd49
- SHA1 af1b7ec663ace0d4a120f1e7006afa4c52ba403a
- SHA512 27e4daabffdcd9e0a9f58600b8b30a7c5322dd936d15ddb2a07a55fc51ef53d0d40a62cd7542acedc24745ad18f1c6498ea7c623903f093e0d6dd282d7b2c77b
- SSDEEP 1536:5xKHTc7duewxwUMtLk/4HIPRksvGILb7zTaZiN:8IduTWnI5vGAHTIu
- TLSH T1C3536C12A350C436E15B593064E8C2725E7E7C226AF494CB7B9903B95FB03D0FA793B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\RemoveSelfSignedCertificate.ps1
- Size 1KB
- SHA256 5ee93c360e91f4753026d47e2e8cf3e7b2bc306e9992fccb88b56fb3e7c718fb
- MD5 317869d5d52e8de74062662898851f4d
- SHA1 c8167809f3652809ebeb984f8c1418e15bde0a98
- SHA512 42b92401c7e5275444cbaa0bcec9e28fa4735ef573d71e3371082156153ab003ece6365e92336b9e6a88f9166cad87354de4882a0acf055573b9e17df9a29627
- TLSH T151217D1422C2A9702FB163A6D503848AF957807B83767D41B1DE80DC5B23C3BD7E855A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8ECF.tmp\nsExec.dll
- Size 7KB
- SHA256 5e66489393f159aa0fd30b630bb345d03418e9324e7d834b2e4195865a637cfe
- MD5 4c77a65bb121bb7f2910c1fa3cb38337
- SHA1 94531e3c6255125c1a85653174737d275bc35838
- SHA512 df50eadf312469c56996c67007d31b85d00e91a4f40355e786536fc0336ac9c2fd8ad9df6e65ab390cc6f031aca28c92212ea23cc40eb600b82a63be3b5b8c04
- SSDEEP 96:JXmkmwmHDqaRrlfAF4IUIqhmKv6vBckXK9wSBl8gvElHturnNQaSGYuHr2DCP:JAjRrlfA6Nv6eWIElNurnNQZGdHc
- TLSH T190E14A3535C03DF7D08D48707C1A2E1B93F0C9321BBA01A08A6B19D576E2AE7F938742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
- Size 529KB
- SHA256 124c592b500d7e89c23ca29e08cca6d49d063b53f62dcb3211c715ae1bbb763c
- MD5 489a2039d7b72df19aa1ee7d5ef27dc6
- SHA1 5106488bbf5278c9f7affaeeb1e772d37ea3bdaa
- SHA512 930a83c81ed87f7ef90651f55299c529a6e82b41624e07c892acea76a662859e71d94a5db7ef6bbdffb7d1167acf03c7051f8b4d8cb7f0795a53e95b90ed9bec
- SSDEEP 12288:RW2DnioX4iBX2+kwFX47D4WChtt4NTrh93oWnI7wtBc:pDnNl5IVTRPc
- TLSH T1FBB44A02F7D08E36E5B29A76D9B7569A4735BD42AF22535F6304F60C38F2600DEB1329
- MD5 SHA1 SHA512 SSDEEP TLSH