xmrig | 38b98174ac3b857a44db550d0a1c7912ed8dd6a8767cfb5702c4b9859dce41f3

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
Size 11.5MB
Sample260604-rxqdfsgw3x
SHA256 38b98174ac3b857a44db550d0a1c7912ed8dd6a8767cfb5702c4b9859dce41f3
MD5 b3e186627ba6aa3a7cb7612347874cb0
SHA1 b565e60cd08539232287e180fdfd754dba1e2788
SHA512 cff70b0a8bd1849cf94690bacd6aa566678a233be9d019163dde5e3584d2a43c64884ce2ca1c6f239f057a1ee85b3c6bfa7bffcd4b2abc627d84f640bb7c76b1
SSDEEP 196608:mn8HEMzW4CMpWXeOJB0p6jgNzY+xOUc+5BEaWqmL7WFIhqvVfO0fnhOgpQ78:7u/ymnWFIhIVO0JOK1
TLSH
T148C69D14FA8710F0DEA74934815BE63FD73079058330EEF7EB94EA58A933691693A325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/2840-0-0x0000000000400000-0x0000000000F99000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral2/memory/2840-0-0x0000000000400000-0x0000000000F99000-memory.dmp	UPX
behavioral2/files/0x001e00000002b3fb-7.dat	UPX
behavioral2/memory/2576-18-0x0000000140000000-0x0000000140053000-memory.dmp	UPX
behavioral2/memory/2708-20-0x0000000140000000-0x0000000140053000-memory.dmp	UPX
behavioral2/memory/4408-27-0x0000000140000000-0x0000000140053000-memory.dmp	UPX
behavioral2/memory/2584-31-0x0000000140000000-0x0000000140053000-memory.dmp	UPX
behavioral2/memory/3308-30-0x0000000140000000-0x0000000140053000-memory.dmp	UPX
behavioral2/memory/2576-25-0x0000000140000000-0x0000000140053000-memory.dmp	UPX
behavioral2/memory/2584-23-0x0000000140000000-0x0000000140053000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/2840-0-0x0000000000400000-0x0000000000F99000-memory.dmp	xmrig

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4196	attrib.exe

Deletes itself 1 IoCs

pid	Process
2492	WScript.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
2576	svchost.exe
4408	svchost.exe
2708	svchost.exe
3308	svchost.exe
2584	svchost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001e00000002b3fb-7.dat	upx
behavioral2/memory/2576-18-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/2708-20-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/4408-27-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/2584-31-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/3308-30-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/2576-25-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/2584-23-0x0000000140000000-0x0000000140053000-memory.dmp	upx

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	\??\c:\windows\Fonts\svchost.exe	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
File created	\??\c:\windows\Fonts\conhost.exe	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
File opened for modification	\??\c:\windows\Fonts\conhost.exe	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
File opened for modification	\??\c:\windows\Fonts\WinRing0x64.sys	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts\sqlservr.exe	attrib.exe
File opened for modification	C:\Windows\system\Speech\synthesis-core.xsd	cmd.exe
File opened for modification	C:\Windows\system\Speech\xml.xsd	cmd.exe
File created	\??\c:\windows\Fonts\WinRing0x64.sys	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
File opened for modification	C:\Windows\system\Speech\speech-synthesis.xsd	cmd.exe

Launches sc.exe 32 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
576	sc.exe
1180	sc.exe
1164	sc.exe
4676	sc.exe
2056	sc.exe
4132	sc.exe
2572	sc.exe
3120	sc.exe
1592	sc.exe
2712	sc.exe
1448	sc.exe
1780	sc.exe
4340	sc.exe
1688	sc.exe
1968	sc.exe
2500	sc.exe
3260	sc.exe
388	sc.exe
4504	sc.exe
1896	sc.exe
2100	sc.exe
1436	sc.exe
4152	sc.exe
4568	sc.exe
1808	sc.exe
4936	sc.exe
4700	sc.exe
3948	sc.exe
1224	sc.exe
2108	sc.exe
4616	sc.exe
4884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 39 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Kills process with WMI 15 IoCs

defense_evasion

pid	Process
2480	WMIC.exe
4940	WMIC.exe
3260	WMIC.exe
3476	WMIC.exe
3964	WMIC.exe
3056	WMIC.exe
1012	WMIC.exe
2868	WMIC.exe
4948	WMIC.exe
4656	WMIC.exe
616	WMIC.exe
2164	WMIC.exe
1028	WMIC.exe
3660	WMIC.exe
3800	WMIC.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1920	taskkill.exe
1592	taskkill.exe
796	taskkill.exe
2804	taskkill.exe
2332	taskkill.exe
3292	taskkill.exe
3396	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe
Token: SeSystemProfilePrivilege	2868	WMIC.exe
Token: SeSystemtimePrivilege	2868	WMIC.exe
Token: SeProfSingleProcessPrivilege	2868	WMIC.exe
Token: SeIncBasePriorityPrivilege	2868	WMIC.exe
Token: SeCreatePagefilePrivilege	2868	WMIC.exe
Token: SeBackupPrivilege	2868	WMIC.exe
Token: SeRestorePrivilege	2868	WMIC.exe
Token: SeShutdownPrivilege	2868	WMIC.exe
Token: SeDebugPrivilege	2868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2868	WMIC.exe
Token: SeRemoteShutdownPrivilege	2868	WMIC.exe
Token: SeUndockPrivilege	2868	WMIC.exe
Token: SeManageVolumePrivilege	2868	WMIC.exe
Token: 33	2868	WMIC.exe
Token: 34	2868	WMIC.exe
Token: 35	2868	WMIC.exe
Token: 36	2868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe
Token: SeSystemProfilePrivilege	2868	WMIC.exe
Token: SeSystemtimePrivilege	2868	WMIC.exe
Token: SeProfSingleProcessPrivilege	2868	WMIC.exe
Token: SeIncBasePriorityPrivilege	2868	WMIC.exe
Token: SeCreatePagefilePrivilege	2868	WMIC.exe
Token: SeBackupPrivilege	2868	WMIC.exe
Token: SeRestorePrivilege	2868	WMIC.exe
Token: SeShutdownPrivilege	2868	WMIC.exe
Token: SeDebugPrivilege	2868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2868	WMIC.exe
Token: SeRemoteShutdownPrivilege	2868	WMIC.exe
Token: SeUndockPrivilege	2868	WMIC.exe
Token: SeManageVolumePrivilege	2868	WMIC.exe
Token: 33	2868	WMIC.exe
Token: 34	2868	WMIC.exe
Token: 35	2868	WMIC.exe
Token: 36	2868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4940	WMIC.exe
Token: SeSecurityPrivilege	4940	WMIC.exe
Token: SeTakeOwnershipPrivilege	4940	WMIC.exe
Token: SeLoadDriverPrivilege	4940	WMIC.exe
Token: SeSystemProfilePrivilege	4940	WMIC.exe
Token: SeSystemtimePrivilege	4940	WMIC.exe
Token: SeProfSingleProcessPrivilege	4940	WMIC.exe
Token: SeIncBasePriorityPrivilege	4940	WMIC.exe
Token: SeCreatePagefilePrivilege	4940	WMIC.exe
Token: SeBackupPrivilege	4940	WMIC.exe
Token: SeRestorePrivilege	4940	WMIC.exe
Token: SeShutdownPrivilege	4940	WMIC.exe
Token: SeDebugPrivilege	4940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4940	WMIC.exe
Token: SeRemoteShutdownPrivilege	4940	WMIC.exe
Token: SeUndockPrivilege	4940	WMIC.exe
Token: SeManageVolumePrivilege	4940	WMIC.exe
Token: 33	4940	WMIC.exe
Token: 34	4940	WMIC.exe
Token: 35	4940	WMIC.exe
Token: 36	4940	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 996	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	80
PID 2840 wrote to memory of 2428	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	81
PID 2840 wrote to memory of 2100	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	82
PID 2840 wrote to memory of 1532	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	83
PID 2840 wrote to memory of 576	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	84
PID 2840 wrote to memory of 4180	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	86
PID 2840 wrote to memory of 1896	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	87
PID 2840 wrote to memory of 1164	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	88
PID 2840 wrote to memory of 3840	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	89
PID 2840 wrote to memory of 4884	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	90
PID 2840 wrote to memory of 4868	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	92
PID 2840 wrote to memory of 4700	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	93
PID 2840 wrote to memory of 2576	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	96
PID 2840 wrote to memory of 4408	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	98
PID 2840 wrote to memory of 2708	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	99
PID 2840 wrote to memory of 3308	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	101
PID 2840 wrote to memory of 4144	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	103
PID 4868 wrote to memory of 916	4868	net.exe	115
PID 2428 wrote to memory of 4200	2428	net.exe	114
PID 3840 wrote to memory of 1260	3840	net.exe	116
PID 1532 wrote to memory of 2716	1532	net.exe	118
PID 4180 wrote to memory of 4060	4180	net.exe	119
PID 4144 wrote to memory of 1504	4144	cmd.exe	120
PID 996 wrote to memory of 448	996	cmd.exe	121
PID 4144 wrote to memory of 2572	4144	cmd.exe	122
PID 4144 wrote to memory of 3260	4144	cmd.exe	123
PID 4144 wrote to memory of 1436	4144	cmd.exe	124
PID 4144 wrote to memory of 3120	4144	cmd.exe	125
PID 4144 wrote to memory of 2804	4144	cmd.exe	126
PID 4144 wrote to memory of 2868	4144	cmd.exe	128
PID 2840 wrote to memory of 2492	2840	2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe	129
PID 4144 wrote to memory of 4940	4144	cmd.exe	130
PID 4144 wrote to memory of 3192	4144	cmd.exe	131
PID 4144 wrote to memory of 3172	4144	cmd.exe	132
PID 4144 wrote to memory of 1592	4144	cmd.exe	133
PID 4144 wrote to memory of 1780	4144	cmd.exe	134
PID 4144 wrote to memory of 3948	4144	cmd.exe	135
PID 4144 wrote to memory of 4132	4144	cmd.exe	136
PID 4144 wrote to memory of 5004	4144	cmd.exe	137
PID 4144 wrote to memory of 808	4144	cmd.exe	138
PID 4144 wrote to memory of 4948	4144	cmd.exe	139
PID 4144 wrote to memory of 2712	4144	cmd.exe	140
PID 4144 wrote to memory of 1224	4144	cmd.exe	141
PID 4144 wrote to memory of 492	4144	cmd.exe	142
PID 4144 wrote to memory of 4932	4144	cmd.exe	143
PID 4144 wrote to memory of 2164	4144	cmd.exe	144
PID 4144 wrote to memory of 2440	4144	cmd.exe	145
PID 4144 wrote to memory of 3480	4144	cmd.exe	146
PID 4144 wrote to memory of 4656	4144	cmd.exe	147
PID 4144 wrote to memory of 1748	4144	cmd.exe	148
PID 4144 wrote to memory of 3388	4144	cmd.exe	149
PID 4144 wrote to memory of 4340	4144	cmd.exe	150
PID 4144 wrote to memory of 4152	4144	cmd.exe	151
PID 4144 wrote to memory of 4240	4144	cmd.exe	152
PID 4144 wrote to memory of 3512	4144	cmd.exe	153
PID 4144 wrote to memory of 616	4144	cmd.exe	154
PID 4144 wrote to memory of 3472	4144	cmd.exe	155
PID 4144 wrote to memory of 3400	4144	cmd.exe	156
PID 4144 wrote to memory of 4676	4144	cmd.exe	157
PID 4144 wrote to memory of 388	4144	cmd.exe	158
PID 4144 wrote to memory of 5068	4144	cmd.exe	159
PID 4144 wrote to memory of 1836	4144	cmd.exe	160
PID 4144 wrote to memory of 1028	4144	cmd.exe	161
PID 4144 wrote to memory of 3436	4144	cmd.exe	162

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
448	attrib.exe
4196	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r -a C:\Windows\Fonts
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:448
- C:\Windows\SysWOW64\net.exe
  net stop MicrosotMaims
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MicrosotMaims
    3⤵
    PID:4200
- C:\Windows\SysWOW64\sc.exe
  sc delete MicrosotMaims
  2⤵
  - Launches sc.exe
  PID:2100
- C:\Windows\SysWOW64\net.exe
  net stop MicrosotMais
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MicrosotMais
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- C:\Windows\SysWOW64\sc.exe
  sc delete MicrosotMais
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Windows\SysWOW64\net.exe
  net stop lanmanserver /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop lanmanserver /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4060
- C:\Windows\SysWOW64\sc.exe
  sc config lanmanserver start= DISABLED 2>nul
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1896
- C:\Windows\SysWOW64\sc.exe
  sc delete lanmanserver
  2⤵
  - Launches sc.exe
  PID:1164
- C:\Windows\SysWOW64\net.exe
  net stop mssecsvc2.0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mssecsvc2.0
    3⤵
    PID:1260
- C:\Windows\SysWOW64\sc.exe
  sc delete mssecsvc2.0
  2⤵
  - Launches sc.exe
  PID:4884
- C:\Windows\SysWOW64\net.exe
  net stop mssecsvc2.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mssecsvc2.1
    3⤵
    PID:916
- C:\Windows\SysWOW64\sc.exe
  sc delete mssecsvc2.1
  2⤵
  - Launches sc.exe
  PID:4700
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe install MicrosotMaims c:\windows\Fonts\conhost.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe set MicrosotMaims DisplayName Network Location Service
  2⤵
  - Executes dropped EXE
  PID:4408
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe set MicrosotMaims Description Provides performance library information from Windows Management.
  2⤵
  - Executes dropped EXE
  PID:2708
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe start MicrosotMaims
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\TEMP\chost.bat
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f.
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\sc.exe
    sc stop Workstation
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2572
- - C:\Windows\SysWOW64\sc.exe
    sc delete Workstation
    3⤵
    - Launches sc.exe
    PID:3260
- - C:\Windows\SysWOW64\sc.exe
    sc stop csrss
    3⤵
    - Launches sc.exe
    PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc delete csrss
    3⤵
    - Launches sc.exe
    PID:3120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrss.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='LDE.exe' and ExecutablePath='C:\\ProgramData\\WinTcpAutoProxySvc\\LDE.exe'" call Terminate
    3⤵
    - Kills process with WMI
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='taskmgr.exe' and ExecutablePath='C:\\Windows\\Temp\\locales\\taskmgr.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3192
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\locales\taskmgr.exe /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinTcpAutoProxySvc
    3⤵
    - Launches sc.exe
    PID:1592
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinTcpAutoProxySvc
    3⤵
    - Launches sc.exe
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc stop WmSrv
    3⤵
    - Launches sc.exe
    PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc delete WmSrv
    3⤵
    - Launches sc.exe
    PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\temp\winstart\myminer.exe /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='myminer.exe' and ExecutablePath='C:\\Windows\\temp\\winstart\\myminer.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:4948
- - C:\Windows\SysWOW64\sc.exe
    sc stop Servc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc delete Servc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:492
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\debug\NAT\systems.exe /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='systems.exe' and ExecutablePath='C:\\Windows\\debug\\NAT\\systems.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2440
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\service.exe" /d everyone
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='TrustedInsteller.exe' and ExecutablePath='C:\\Program Files\\Common Files\\Services\\TrustedInsteller.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Common Files\Services\TrustedInsteller.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop Microsoft.NET_Framework_NGEN
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4340
- - C:\Windows\SysWOW64\sc.exe
    sc delete Microsoft.NET_Framework_NGEN
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4240
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Internet Explorer\en-US\A+\svchost.exe" /d everyone
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='svchost.exe' and ExecutablePath='C:\\ProgramData\\vmicvess\\svchost.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\vmicvess\svchost.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc stop vmicvess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4676
- - C:\Windows\SysWOW64\sc.exe
    sc delete vmicvess
    3⤵
    - Launches sc.exe
    PID:388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\inetsrv\102\svchost.exe" /d everyone
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\SysWOW64\\inetsrv\\102\\svchost.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\debug\nat\systems.exe" /d everyone
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='systems.exe' and ExecutablePath='C:\\Windows\\debug\\nat\\systems.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:3476
- - C:\Windows\SysWOW64\sc.exe
    sc stop smtpsvrch
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc delete smtpsvrch
    3⤵
    - Launches sc.exe
    PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc stop smtpsvrZy
    3⤵
    - Launches sc.exe
    PID:1968
- - C:\Windows\SysWOW64\sc.exe
    sc delete smtpsvrZy
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Restorgj\zy\zy.exe" /d everyone
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Restorgj\ch\▓Γ╩╘╘│═°┬τ╝α▓Γ.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Restorgj\ch\FLBrowser.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Restorgj\ch\Clean.exe" /d everyone
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im flbrowser.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ▓Γ╩╘╘│═°┬τ╝α▓Γ.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im zy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Clean.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "c:\windows\mscorswv.exe" /d everyone
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\sc.exe
    sc stop sqlservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1448
- - C:\Windows\SysWOW64\sc.exe
    sc delete sqlservice
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\conhost\conhost.exe" /d everyone
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Common Files\SpeechEngines\wmiapsvr.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:668
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\data\service.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
- - C:\Windows\SysWOW64\sc.exe
    sc stop taskmrg
    3⤵
    - Launches sc.exe
    PID:4504
- - C:\Windows\SysWOW64\sc.exe
    sc delete taskmrg
    3⤵
    - Launches sc.exe
    PID:2500
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='service.exe' and ExecutablePath='C:\\Windows\\data\\service.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:3964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Common Files\Services\TrustedInsteller.exe" /d everyone
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='TrustedInsteller.exe' and ExecutablePath='C:\\Program Files\\Common Files\\Services\\TrustedInsteller.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\windows\system32\dllhostex.exe" /d everyone
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='dllhostex.exe' and ExecutablePath='C:\\windows\\system32\\dllhostex.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:3260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\hyc\xqwkhyc.exe" /d everyone
    3⤵
    PID:32
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='xqwkhyc.exe' and ExecutablePath='C:\\Windows\\hyc\\xqwkhyc.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:3660
- - C:\Windows\SysWOW64\sc.exe
    sc stop nat
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1808
- - C:\Windows\SysWOW64\sc.exe
    sc delete nat
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\cacls.exe
    cacls "c:\windows\debug\nat\explorer.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='explorer.exe' and ExecutablePath='c:\\windows\\debug\\nat\\explorer.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cacls.exe
    cacls "c:\windows\java\java.exe" /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='java.exe' and ExecutablePath='C:\\windows\\java\\java.exe'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with WMI
    PID:1012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im sqlservr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1592
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='sqlservr.exe' and ExecutablePath='C:\\Windows\\Fonts\\sqlservr.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:2480
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\Fonts\sqlservr.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Fonts\sqlservr.exe /d everyone
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc start PolicyAgent
    3⤵
    - Launches sc.exe
    PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc config PolicyAgent start= AUTO
    3⤵
    - Launches sc.exe
    PID:1180
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static del all
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:784
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=Aliyun
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2164
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3480
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1748
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:592
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5112
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4676
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2484
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=Allow action=permit
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1680
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=deny action=block
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add rule name=deny1 policy=Aliyun filterlist=denylist filteraction=deny
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1884
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static set policy name=Aliyun assign=y
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im lsars.exe /im lsacs.exe
    3⤵
    - Kills process with taskkill
    PID:796
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2492

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe
1⤵
- Executes dropped EXE
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

tem.vbs

Path C:\Users\Admin\AppData\Local\Temp\tem.vbs
Size 332B
SHA256 e425f3e4d41c3e377afae37f385cd15c3d15150d2d41ec611fa115d21f1e207d
MD5 9a0fe10e17a096e253f268e82de7004b
SHA1 989266def282b695f0bbeaab81ef8ce6a67fcd69
SHA512 32d98497f50c1c54d8efd634f039a509395ba9092b65fb9cc9e935cc14cf0b86eff07f92ebea7380d28ab5f87ddc98f72b1b41e7641bdf53b69b51a81b94d64c
TLSH
T152E026219E83EAAC2037850388A28C0EF46024086F62A21466E0EAC86F926296A41386
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\Fonts\svchost.exe
Size 87KB
SHA256 516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c
MD5 3215a773eecd1089babe6b9975086ebd
SHA1 6f28080e58149aeb72dfd0f2568ce80de4eff43c
SHA512 664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad
SSDEEP 1536:yRYh74DJEup8S69OLvbBiq5B6r9par9bXQ/WOd2QDgTVpBWsKu+q:yRYC1Eup4sAqH63ar5XyIQDgTVpUGF
TLSH
T17293025BC1BC922CC28125B3CE3E164CF6257C79892FC73F6A9E693EBE515C24362610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chost.bat

Path C:\Windows\TEMP\chost.bat
Size 5KB
SHA256 4bafdf990225d692cb6afcc4435445f1bb37efd12233d43249a5ff02b7e66d7c
MD5 76af31a73294119101713b306826d9ca
SHA1 cd13193ccc62bdcf8d6d8edb871159001c98afcb
SHA512 6fdc5ebe79d8720f3db4c6235bb26c73c46c521014d7f424b36185fc959273030e61eff10747d7cc43fd274fa1f4829ec102d5339b4b22c942acb6136ab9941d
SSDEEP 96:L/GymfMZxB+YVYbOsVsGps4zMGGE/QY0ngj5jOodE6Z76l1W:Tmzv0ngNjVZ76l1W
TLSH
T13CC10028993B936198D0E573E7012713F6ADF60762E83E8027C85157BA100DDC67DBEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-18-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/2576-25-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/2584-31-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/2584-23-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/2708-20-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/2840-0-0x0000000000400000-0x0000000000F99000-memory.dmp

Download

memory/3308-30-0x0000000140000000-0x0000000140053000-memory.dmp

Download

memory/4408-27-0x0000000140000000-0x0000000140053000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads