mofksys | e9b82fbd044bb1ca66f8a877e1978ecd60c6c1eb566add3bbff2c08f930f9b43

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
Size 18.9MB
Sample260601-s8ypmsa14k
SHA256 e9b82fbd044bb1ca66f8a877e1978ecd60c6c1eb566add3bbff2c08f930f9b43
MD5 a7a24e96feda94dce2241e156aeb5690
SHA1 e0120e77bd3f40ecb77c951871336a7ff092ef4e
SHA512 c92bc6adbbbc638643c4cb97e69fd3665a52c8db8e0b8fe56974b7258a88006311993b1e34457d249cb3b8c62b8c9e0c79e15dd8a285a1be1c49e2ff3276ec21
SSDEEP 393216:zdCqFTywoCkhfO/zFXGW/F/P9wXiXzThRmeC/+pWt0p7:zdXFTXRkdObGXYztRyMa01
TLSH
T19B17BF11FBD600B0F673927085AAD73BC6377A110531DEAFF74C8A497B33A915A2A316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution mofksys persistence spyware worm

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 13 IoCs

resource	yara_rule
behavioral2/memory/3824-0-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x002100000002b40b-43.dat	family_mofksys
behavioral2/files/0x001d00000002b521-51.dat	family_mofksys
behavioral2/memory/240-53-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x001a00000002b52a-61.dat	family_mofksys
behavioral2/files/0x001a00000002b52d-68.dat	family_mofksys
behavioral2/memory/548-77-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/3100-80-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/1420-81-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/3824-82-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x001a00000002b530-83.dat	family_mofksys
behavioral2/memory/240-191-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/4560-192-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3496	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 10 IoCs

pid	Process
4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
3860	files.dat
1420	icsys.icn.exe
240	explorer.exe
3100	spoolsv.exe
4560	svchost.exe
548	spoolsv.exe
4584	rld20297.exe
564	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
2112	oinstrun.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rld20297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
996	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OUTLOOK.EXE

Runs .reg file with regedit 1 IoCs

pid	Process
2752	regedit.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
996	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4172	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3496	powershell.exe
3496	powershell.exe
1420	icsys.icn.exe
1420	icsys.icn.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
4560	svchost.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
240	explorer.exe
240	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
240	explorer.exe
4560	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: 36	920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: 36	920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4836	WMIC.exe
Token: SeSecurityPrivilege	4836	WMIC.exe
Token: SeTakeOwnershipPrivilege	4836	WMIC.exe
Token: SeLoadDriverPrivilege	4836	WMIC.exe
Token: SeSystemProfilePrivilege	4836	WMIC.exe
Token: SeSystemtimePrivilege	4836	WMIC.exe
Token: SeProfSingleProcessPrivilege	4836	WMIC.exe
Token: SeIncBasePriorityPrivilege	4836	WMIC.exe
Token: SeCreatePagefilePrivilege	4836	WMIC.exe
Token: SeBackupPrivilege	4836	WMIC.exe
Token: SeRestorePrivilege	4836	WMIC.exe
Token: SeShutdownPrivilege	4836	WMIC.exe
Token: SeDebugPrivilege	4836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4836	WMIC.exe
Token: SeRemoteShutdownPrivilege	4836	WMIC.exe
Token: SeUndockPrivilege	4836	WMIC.exe
Token: SeManageVolumePrivilege	4836	WMIC.exe
Token: 33	4836	WMIC.exe
Token: 34	4836	WMIC.exe
Token: 35	4836	WMIC.exe
Token: 36	4836	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4836	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
3824	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
3824	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
1420	icsys.icn.exe
1420	icsys.icn.exe
240	explorer.exe
240	explorer.exe
3100	spoolsv.exe
3100	spoolsv.exe
4560	svchost.exe
4560	svchost.exe
548	spoolsv.exe
548	spoolsv.exe
240	explorer.exe
240	explorer.exe
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE
4172	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4948	3824	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	81
PID 4948 wrote to memory of 2936	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	83
PID 4948 wrote to memory of 2656	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	85
PID 2936 wrote to memory of 920	2936	cmd.exe	87
PID 4948 wrote to memory of 2388	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	89
PID 4948 wrote to memory of 1140	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	91
PID 2388 wrote to memory of 3860	2388	cmd.exe	92
PID 1140 wrote to memory of 4836	1140	cmd.exe	94
PID 4948 wrote to memory of 3496	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	95
PID 3824 wrote to memory of 1420	3824	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	97
PID 1420 wrote to memory of 240	1420	icsys.icn.exe	98
PID 240 wrote to memory of 3100	240	explorer.exe	99
PID 3100 wrote to memory of 4560	3100	spoolsv.exe	100
PID 4560 wrote to memory of 548	4560	svchost.exe	101
PID 4560 wrote to memory of 4416	4560	svchost.exe	102
PID 4948 wrote to memory of 3688	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	106
PID 4948 wrote to memory of 3272	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	108
PID 4948 wrote to memory of 1640	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	110
PID 4948 wrote to memory of 4788	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	112
PID 4948 wrote to memory of 1600	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	114
PID 4948 wrote to memory of 4172	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	116
PID 1600 wrote to memory of 2752	1600	cmd.exe	117
PID 4948 wrote to memory of 4584	4948	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	118
PID 4584 wrote to memory of 564	4584	rld20297.exe	120
PID 4584 wrote to memory of 2684	4584	rld20297.exe	121
PID 564 wrote to memory of 2128	564	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	123
PID 564 wrote to memory of 5024	564	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	124
PID 2684 wrote to memory of 996	2684	cmd.exe	127
PID 5024 wrote to memory of 244	5024	cmd.exe	128
PID 564 wrote to memory of 2904	564	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	129
PID 2904 wrote to memory of 3296	2904	cmd.exe	131
PID 564 wrote to memory of 2112	564	2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe	133
PID 4560 wrote to memory of 1816	4560	svchost.exe	136
PID 4560 wrote to memory of 4920	4560	svchost.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824
- \??\c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
  c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe "
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
    3⤵
    PID:2656
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /D /c files.dat -y -pkmsauto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - \??\c:\users\admin\appdata\local\temp\files\files.dat
      files.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3860
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\files"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\files"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3496
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServiceName /t REG_SZ /d kms.loli.best /f
    3⤵
    PID:3688
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServicePort /t REG_SZ /d 1688 /f
    3⤵
    PID:3272
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServiceName /t REG_SZ /d kms.loli.best /f
    3⤵
    PID:1640
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServicePort /t REG_SZ /d 1688 /f
    3⤵
    PID:4788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /D /c regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\regedit.exe
      regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
      4⤵
      Runs .reg file with regedit
      PID:2752
- - C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
    "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\rld20297.exe
    "C:\Users\Admin\AppData\Local\Temp\rld20297.exe" "c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe " 1000
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - \??\c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
      "c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe "
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2128
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe "
        6⤵
        
        PID:244
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\files"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="c:\users\admin\appdata\local\temp\files"
        6⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\oinstrun.exe" "c:\users\admin\appdata\local\temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe "
        5⤵
        Executes dropped EXE
        
        PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SelfD97585.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:996
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1420
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:240
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3100
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:548
      - C:\Windows\SysWOW64\at.exe
        
        at 16:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
      - C:\Windows\SysWOW64\at.exe
        
        at 16:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
      - C:\Windows\SysWOW64\at.exe
        
        at 16:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos.exe
Size 18.7MB
SHA256 2ff9f800cfe3e450b9feb25c171c6813c6e100506068fd4da25a5c7255d6b0dc
MD5 80f8a2ffd54a73c6cc17f427d10dd1da
SHA1 099b916641cdb3cb66aa9242bcb92b00ebce8475
SHA512 ca420d70aaa290b490e37db18ab691f3497e3adea37d1fd8f623024333275b2110d5a8a66ce54102b238c026ce0bba35b0a8998c0a63db2ab89d06a74d07a845
SSDEEP 393216:gCqFTywoCkhfO/zFXGW/F/P9wXiXzThRmeC/+pWt0p+:gXFTXRkdObGXYztRyMa0c
TLSH
T1F717BF11FBD600B0F673927085AAD33BC63779114532DEAFF64C8A497B33A915A2E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfD97585.bat

Path C:\Users\Admin\AppData\Local\Temp\SelfD97585.bat
Size 157B
SHA256 be0435315f9718ce44c921d109965f115f0de0f985a2b205a8ea35248f1c7dd4
MD5 534655876a447fd4de195a42b1f197ca
SHA1 6680ef07a7684b13dee6ea0443e7c3f9f31a32ae
SHA512 135a4330c365f2c2967277e3c07a79fca59a7427f532eceebf7e55ccad6637b26b3fb9a0361babb15b90f67b73a92f5bdcd16fedcfa80c430f8aae484b5f1488
TLSH
T1D9C080304AC7C715040881770A18A14DC0754C4E2F062754B7234CCC814141D6F40F01
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3ntdrkgi.lmu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ntdrkgi.lmu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 765KB
SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
MD5 bb5569b15d68c10b7ff2d96b45825120
SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
TLSH
T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
Size 7.3MB
SHA256 caf295438040eca0632d475eeecf51a16307a23cb87dcfce796d274e8e8ff221
MD5 6b6f44e4ef1ee8fb94ea28aed02964fb
SHA1 c9f845c97b5c5863682c2f38f8f1ed26377b4dfb
SHA512 3227a32cf7bc64354ce81f7959299da612bc8a180aec0fafdd2d335354f85739984e389630ef5b9663cf98797a28f2ea0eb44cec6c905db50099a908cca11bd6
SSDEEP 196608:hXqTPuiy2bA5G4GGxNd226ALHcXSHo36r6weCUJaI6HMaJTtGb8b:tSuiy2Qx76ALHqK6wxBb
TLSH
T1E4766C2277E78076E5F202706DFDAB1985BDBE7119F0811F62881A1E0A70BB195E7733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newui.reg

Path C:\Users\Admin\AppData\Local\Temp\newui.reg
Size 1KB
SHA256 92dc5f009e30e42d18b80fdcce0e029df6d56e387eb38e16c5585a9c5a0b41a7
MD5 7fb2bda7ca25568909eab0b872416ada
SHA1 23295a06a82a9ef408ec0409e6bc5f15c045c895
SHA512 ea07f1a90991410d044bfc0420c2de4d2e445b30c62199277ab26b9a8ba11603e0652caa24bb26a2429cc6c12d76fc627751476b133158617e4439a7e59a883d
TLSH
T14B31F593E0158632E0553F1175932F893BBA03C77467ADE6832940D42266957C3D7AB7
MD5 SHA1 SHA512 TLSH

Submit Download

oinstrun.exe

Path C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
Size 14KB
SHA256 4a01c55f4727b3771c2672421aa2c5c20534ad0530449ed168a16a3d33345d3d
MD5 32973232138fc6b30d913167096c059d
SHA1 d6a7cb95d5525ea3d7286749663e12c1addb3104
SHA512 ce0ca843705f7059bad14260a48647797a6cb2d84c162aa943eb090a7d18f708a3403d94f92fbc67c1b1216f941bf591f358e35fef76db34125f37595e256b9f
SSDEEP 384:t0TE7lQWycenV30bCeFBgb4kkAeZn9N9TsW0ClG6VEu2QWGrWvNUTsrwHaU:t0T0lQhUs
TLSH
T1FA62A38097EC4499F0FB4F30EDBA41029ABAFD515E75D12F0150508E1AB2B61DE7AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rld20297.exe

Path C:\Users\Admin\AppData\Local\Temp\rld20297.exe
Size 16KB
SHA256 03382bd8037a9cf6905c87b98b6768bd93fec22faf2f4092d81ac970703ea14f
MD5 fc8ec75b7b5f3a2be9fdc67ee8808afa
SHA1 e5723567f6f3d12c2eaea3d07955cf5a259c8a8f
SHA512 c83ee781775fef4f65244b108bd9ac88643340375b0a2880af9c5d44259ea2f416130c01da0279eb2683988fdf7fc1f8a91e5b013bef28ceb3a086da5ac8bc2a
SSDEEP 192:WnI7XWYyywYGoT8uiAe+jlsSUFagW+b43iyRJvaofC1upLKLw9glGfqWJJR48F8:YWGYyjuQ++SUcgxNualcpLT9wGlJM8O
TLSH
T1AB722A23EEC168F6E6D380B30BB59927DD35121153444AD7E3EC9DA93B105D0E73A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ver.txt

Path C:\Users\Admin\AppData\Local\Temp\ver.txt
Size 67KB
SHA256 dde66188cba261ad86ccf6b4b6328bb0439a516597220e6007372b3f1c639ed4
MD5 f213bee70fabd610bd743c76cf72ed86
SHA1 6235f4016497b01bcc10f5d25a660da11ef65db8
SHA512 9cc0af2adf1f287822e91ff7da8e250a1115939f9e1d3239ba0751c5386a78e5a5a3bde843ff3e1291293c8ca2a9903837625e6e2934712264c5983ef6cbf07d
SSDEEP 1536:a0Mu8Xdcwz0mXz9kjTY+nVyHTdepQOCB1yUWVgPQpquhYdnNk/0Hk2IIoBUTXN6d:I6
TLSH
T1D0632562C5328EBB3AB4332869B08741F6F023DF12941C5B35BD0E6D5F379226275E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 767cb86e2061ce0f819865bb1da4cc9662ca7746979a9f6ab70ae9661a252de8
MD5 f713ee312afd348461a69606ae312ef7
SHA1 bb958e4332cb59bc6024b1d8c675232c98b0d4c0
SHA512 12b5365758d1e65fadb5856eab1a1a71ca3b11f083e07f82931e3dc02570384e89d76ba1729753d325f5b2aa1608031d73c7e5a1560bc41bbf686dc05420a674
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unU:5vEN2U+T6i5LirrllHy4HUcMQY6p
TLSH
T13424F86FFA10702DE9AAD6F16427E69BB6211E651B809C8F23D0AF453076613B0F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 c96cffe453493998fbec6332b4b64fd7b315126232c005619399d5863b04a70d
MD5 9b9decf1257936313bdef4ed89512f3b
SHA1 a8f340036872e393863f764f77a9be50a58c95de
SHA512 3d4ca2afde47975ffa59062103cdfb6d01f24677f2e43b5cb1a2b66a1c6f411cbe6ea3352a0e6ffddf83c30352df59c59228e52797a72d9e50e5d5fc60c43b71
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unn:5vEN2U+T6i5LirrllHy4HUcMQY6Q
TLSH
T1EB24E71BEA14301ED4A3CAF0582BA99ABA711D720F96AC0B63D1AF4535B5513B1F132F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 206KB
SHA256 9e2aa8b8395c045886a259b69f0025ecabb32855111cfa3c5f7816b360d136bc
MD5 2a9ec075776872560276e7454b61d0f8
SHA1 2d30f1875de2092c7ad3e5f855ac134edbf77a1a
SHA512 b3aa361cc24a9ec6a8908dab81a376a12750bcfd230b9a2fa8ef681f69fdacd8becb5a3be9b65daa9e9a6cecc6b0c8e2a5ac6ba01b2aafbc3bc6f79d9246b12e
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unf:5vEN2U+T6i5LirrllHy4HUcMQY6o
TLSH
T10624E69BEA01202ED8B386F0186BA5B67B612D341F80AC4B67D16F5639F5583B0F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 206KB
SHA256 e548c9a9791aa0c6e88d174fbf644faf69afc44b454847525098113e5f6bbb65
MD5 6bea8475cf25eba9c86b1e19877bbf4d
SHA1 4a435d2f246a370d34552bfc23f4facfffb6b2a3
SHA512 bbb5bada90a06b42db8d41ad7b318ccdbd4a3d83180c0fdd6ee4f30f289957a4acc5a5ded4f1ebd50a5a7df82121810777ff7927f1fcbe1748023cadc46ee562
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uno:5vEN2U+T6i5LirrllHy4HUcMQY6/
TLSH
T15324F83FEE50702EE85686F05823E9A6B6326D221B919C4F67D0AF853471913B2F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configure.xml

Path \??\c:\users\admin\appdata\local\temp\files\configure.xml
Size 1KB
SHA256 aab7da15c94292ef647b83dc6c50c75973458af01586b8532cb6b12e9130c003
MD5 9c9e98bc39c9a0a0990b6006e09e555e
SHA1 3d43e96ddc96fdd0bd76f5f3c54b92b40ade5a8b
SHA512 e0dc9e768a8a8ec3f19f7311675892ed68ecc73535d17af55aac23ccc6224c3b8a3d964957d9158c001267cdcaafd29c8b343ce90bf1eb514f6b0a80fb6606a6
TLSH
T1D0310A9A5E889C3C66660332F296CFC47F795917571408B170CF192B2F5156403A709F
MD5 SHA1 SHA512 TLSH

Submit Download

spoolsv.exe

Path \??\c:\windows\system\spoolsv.exe
Size 206KB
SHA256 b403426a1c06ea4328f15dd5e06305b233f72cff243ab9f218d32199e4173684
MD5 d5bac79e1e81d8fb0b897c1589188634
SHA1 91cc0adad903f07172b385084f007b4483e94db5
SHA512 0ee0de34b8bbbac09b654d2ad7bdd3f8df55d2b2b72eb71a125ff34f423a024d4f4b29da75460f188aaa0ebf187a3d21293abc50f2da75d49bf3e3394b6531d2
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un+:5vEN2U+T6i5LirrllHy4HUcMQY6j
TLSH
T14024D62FFE10302FD463C5F06862A6A6BB216E321F969C4B67D2AB456572103B1F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-191-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/240-53-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/548-77-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1420-81-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3100-80-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3496-87-0x0000025107130000-0x0000025107BF2000-memory.dmp

Download

memory/3496-33-0x000002511FEE0000-0x000002511FF02000-memory.dmp

Download

memory/3824-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3824-82-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4172-104-0x00007FF8CB0B0000-0x00007FF8CB0C0000-memory.dmp

Download

memory/4172-100-0x00007FF8CB0B0000-0x00007FF8CB0C0000-memory.dmp

Download

memory/4172-102-0x00007FF8CB0B0000-0x00007FF8CB0C0000-memory.dmp

Download

memory/4172-112-0x00007FF8C8CA0000-0x00007FF8C8CB0000-memory.dmp

Download

memory/4172-113-0x00007FF8C8CA0000-0x00007FF8C8CB0000-memory.dmp

Download

memory/4172-103-0x00007FF8CB0B0000-0x00007FF8CB0C0000-memory.dmp

Download

memory/4172-101-0x00007FF8CB0B0000-0x00007FF8CB0C0000-memory.dmp

Download

memory/4560-192-0x0000000000400000-0x0000000000440000-memory.dmp

Download