Analysis
- max time kernel
42s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 00:03
General
- Target 2026-06-25_121a9909c0105322ede37a43957a105c_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
- Size 10.4MB
- Sample260630-ab3yzsbt4p
- SHA256 b4f95fd212d072534ebf91335dd1a62bdd5751bbc7c7fc5504a69e290a1b1691
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 22 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 15 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 49 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_121a9909c0105322ede37a43957a105c_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_121a9909c0105322ede37a43957a105c_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_121a9909c0105322ede37a43957a105c_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exeC:\Users\Admin\AppData\Local\Temp\2026-06-25_121a9909c0105322ede37a43957a105c_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update zdhkhrogki.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\zdhkhrogki.exeC:\Users\Admin\AppData\Local\Temp\zdhkhrogki.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zdhkhrogki.exeC:\Users\Admin\AppData\Local\Temp\zdhkhrogki.exe update geolmjwueu.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\geolmjwueu.exeC:\Users\Admin\AppData\Local\Temp\geolmjwueu.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\geolmjwueu.exeC:\Users\Admin\AppData\Local\Temp\geolmjwueu.exe update zazcfpyrxo.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\zazcfpyrxo.exeC:\Users\Admin\AppData\Local\Temp\zazcfpyrxo.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zazcfpyrxo.exeC:\Users\Admin\AppData\Local\Temp\zazcfpyrxo.exe update mheljujvey.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mheljujvey.exeC:\Users\Admin\AppData\Local\Temp\mheljujvey.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mheljujvey.exeC:\Users\Admin\AppData\Local\Temp\mheljujvey.exe update hvurbwgfyy.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hvurbwgfyy.exeC:\Users\Admin\AppData\Local\Temp\hvurbwgfyy.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hvurbwgfyy.exeC:\Users\Admin\AppData\Local\Temp\hvurbwgfyy.exe update rlpciklodu.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\rlpciklodu.exeC:\Users\Admin\AppData\Local\Temp\rlpciklodu.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rlpciklodu.exeC:\Users\Admin\AppData\Local\Temp\rlpciklodu.exe update dyptfsnudd.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exeC:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exeC:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exe update axtbhksoom.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\axtbhksoom.exeC:\Users\Admin\AppData\Local\Temp\axtbhksoom.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\axtbhksoom.exeC:\Users\Admin\AppData\Local\Temp\axtbhksoom.exe update qjmkhuvfiy.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\qjmkhuvfiy.exeC:\Users\Admin\AppData\Local\Temp\qjmkhuvfiy.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qjmkhuvfiy.exeC:\Users\Admin\AppData\Local\Temp\qjmkhuvfiy.exe update kfcrelolqc.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\kfcrelolqc.exeC:\Users\Admin\AppData\Local\Temp\kfcrelolqc.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kfcrelolqc.exeC:\Users\Admin\AppData\Local\Temp\kfcrelolqc.exe update isussknply.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\isussknply.exeC:\Users\Admin\AppData\Local\Temp\isussknply.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\isussknply.exeC:\Users\Admin\AppData\Local\Temp\isussknply.exe update yrhnybxbzf.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\yrhnybxbzf.exeC:\Users\Admin\AppData\Local\Temp\yrhnybxbzf.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\yrhnybxbzf.exeC:\Users\Admin\AppData\Local\Temp\yrhnybxbzf.exe update hcjuvwqiaz.exe14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hcjuvwqiaz.exeC:\Users\Admin\AppData\Local\Temp\hcjuvwqiaz.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\hcjuvwqiaz.exeC:\Users\Admin\AppData\Local\Temp\hcjuvwqiaz.exe update cxiaxrjxtx.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exeC:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exeC:\Users\Admin\AppData\Local\Temp\cxiaxrjxtx.exe update mnhkpxylnc.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mnhkpxylnc.exeC:\Users\Admin\AppData\Local\Temp\mnhkpxylnc.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\mnhkpxylnc.exeC:\Users\Admin\AppData\Local\Temp\mnhkpxylnc.exe update zbvcknrmrc.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zbvcknrmrc.exeC:\Users\Admin\AppData\Local\Temp\zbvcknrmrc.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\zbvcknrmrc.exeC:\Users\Admin\AppData\Local\Temp\zbvcknrmrc.exe update frntccsgyd.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\frntccsgyd.exeC:\Users\Admin\AppData\Local\Temp\frntccsgyd.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\frntccsgyd.exeC:\Users\Admin\AppData\Local\Temp\frntccsgyd.exe update jjmxswsaop.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jjmxswsaop.exeC:\Users\Admin\AppData\Local\Temp\jjmxswsaop.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\jjmxswsaop.exeC:\Users\Admin\AppData\Local\Temp\jjmxswsaop.exe update zvwtgypaod.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zvwtgypaod.exeC:\Users\Admin\AppData\Local\Temp\zvwtgypaod.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\zvwtgypaod.exeC:\Users\Admin\AppData\Local\Temp\zvwtgypaod.exe update tdsbcvyrjg.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tdsbcvyrjg.exeC:\Users\Admin\AppData\Local\Temp\tdsbcvyrjg.exe21⤵
-
C:\Users\Admin\AppData\Local\Temp\tdsbcvyrjg.exeC:\Users\Admin\AppData\Local\Temp\tdsbcvyrjg.exe update wyxwcdpbrq.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wyxwcdpbrq.exeC:\Users\Admin\AppData\Local\Temp\wyxwcdpbrq.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\wyxwcdpbrq.exeC:\Users\Admin\AppData\Local\Temp\wyxwcdpbrq.exe update wctnwbbeht.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wctnwbbeht.exeC:\Users\Admin\AppData\Local\Temp\wctnwbbeht.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\wctnwbbeht.exeC:\Users\Admin\AppData\Local\Temp\wctnwbbeht.exe update mafyivpplk.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mafyivpplk.exeC:\Users\Admin\AppData\Local\Temp\mafyivpplk.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\mafyivpplk.exeC:\Users\Admin\AppData\Local\Temp\mafyivpplk.exe update bxzoxpjakz.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bxzoxpjakz.exeC:\Users\Admin\AppData\Local\Temp\bxzoxpjakz.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\bxzoxpjakz.exeC:\Users\Admin\AppData\Local\Temp\bxzoxpjakz.exe update rjzegfyrtv.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rjzegfyrtv.exeC:\Users\Admin\AppData\Local\Temp\rjzegfyrtv.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\rjzegfyrtv.exeC:\Users\Admin\AppData\Local\Temp\rjzegfyrtv.exe update ozpcfythdx.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ozpcfythdx.exeC:\Users\Admin\AppData\Local\Temp\ozpcfythdx.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\ozpcfythdx.exeC:\Users\Admin\AppData\Local\Temp\ozpcfythdx.exe update tnjyyozcsg.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tnjyyozcsg.exeC:\Users\Admin\AppData\Local\Temp\tnjyyozcsg.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\tnjyyozcsg.exeC:\Users\Admin\AppData\Local\Temp\tnjyyozcsg.exe update yzfqpgptjm.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yzfqpgptjm.exeC:\Users\Admin\AppData\Local\Temp\yzfqpgptjm.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\yzfqpgptjm.exeC:\Users\Admin\AppData\Local\Temp\yzfqpgptjm.exe update yhorzdpyum.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yhorzdpyum.exeC:\Users\Admin\AppData\Local\Temp\yhorzdpyum.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\yhorzdpyum.exeC:\Users\Admin\AppData\Local\Temp\yhorzdpyum.exe update trsscmgbws.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\trsscmgbws.exeC:\Users\Admin\AppData\Local\Temp\trsscmgbws.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\trsscmgbws.exeC:\Users\Admin\AppData\Local\Temp\trsscmgbws.exe update qeydgbtwth.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qeydgbtwth.exeC:\Users\Admin\AppData\Local\Temp\qeydgbtwth.exe32⤵
-
C:\Users\Admin\AppData\Local\Temp\qeydgbtwth.exeC:\Users\Admin\AppData\Local\Temp\qeydgbtwth.exe update qbxbuyaukc.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qbxbuyaukc.exeC:\Users\Admin\AppData\Local\Temp\qbxbuyaukc.exe33⤵
-
C:\Users\Admin\AppData\Local\Temp\qbxbuyaukc.exeC:\Users\Admin\AppData\Local\Temp\qbxbuyaukc.exe update beyphwtwae.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\beyphwtwae.exeC:\Users\Admin\AppData\Local\Temp\beyphwtwae.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\beyphwtwae.exeC:\Users\Admin\AppData\Local\Temp\beyphwtwae.exe update amwssfpolw.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\amwssfpolw.exeC:\Users\Admin\AppData\Local\Temp\amwssfpolw.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\amwssfpolw.exeC:\Users\Admin\AppData\Local\Temp\amwssfpolw.exe update foqqaeauwa.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\foqqaeauwa.exeC:\Users\Admin\AppData\Local\Temp\foqqaeauwa.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\foqqaeauwa.exeC:\Users\Admin\AppData\Local\Temp\foqqaeauwa.exe update iysrrcvsgq.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exeC:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exeC:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exe update ndxcbgnadh.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ndxcbgnadh.exeC:\Users\Admin\AppData\Local\Temp\ndxcbgnadh.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\ndxcbgnadh.exeC:\Users\Admin\AppData\Local\Temp\ndxcbgnadh.exe update ivciqpbdim.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ivciqpbdim.exeC:\Users\Admin\AppData\Local\Temp\ivciqpbdim.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\ivciqpbdim.exeC:\Users\Admin\AppData\Local\Temp\ivciqpbdim.exe update giigfmvpsz.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\giigfmvpsz.exeC:\Users\Admin\AppData\Local\Temp\giigfmvpsz.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\giigfmvpsz.exeC:\Users\Admin\AppData\Local\Temp\giigfmvpsz.exe update nxccltbscb.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nxccltbscb.exeC:\Users\Admin\AppData\Local\Temp\nxccltbscb.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\nxccltbscb.exeC:\Users\Admin\AppData\Local\Temp\nxccltbscb.exe update kzhysyxtvg.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kzhysyxtvg.exeC:\Users\Admin\AppData\Local\Temp\kzhysyxtvg.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\kzhysyxtvg.exeC:\Users\Admin\AppData\Local\Temp\kzhysyxtvg.exe update nnwrpaolmh.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nnwrpaolmh.exeC:\Users\Admin\AppData\Local\Temp\nnwrpaolmh.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\nnwrpaolmh.exeC:\Users\Admin\AppData\Local\Temp\nnwrpaolmh.exe update qfzxsxhbzv.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qfzxsxhbzv.exeC:\Users\Admin\AppData\Local\Temp\qfzxsxhbzv.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\qfzxsxhbzv.exeC:\Users\Admin\AppData\Local\Temp\qfzxsxhbzv.exe update vwqazfddeg.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vwqazfddeg.exeC:\Users\Admin\AppData\Local\Temp\vwqazfddeg.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\vwqazfddeg.exeC:\Users\Admin\AppData\Local\Temp\vwqazfddeg.exe update pkfuxhcvvh.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pkfuxhcvvh.exeC:\Users\Admin\AppData\Local\Temp\pkfuxhcvvh.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\pkfuxhcvvh.exeC:\Users\Admin\AppData\Local\Temp\pkfuxhcvvh.exe update rnjfjkhktj.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rnjfjkhktj.exeC:\Users\Admin\AppData\Local\Temp\rnjfjkhktj.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\rnjfjkhktj.exeC:\Users\Admin\AppData\Local\Temp\rnjfjkhktj.exe update ujyyomyvtk.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ujyyomyvtk.exeC:\Users\Admin\AppData\Local\Temp\ujyyomyvtk.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\ujyyomyvtk.exeC:\Users\Admin\AppData\Local\Temp\ujyyomyvtk.exe update ptlxxiwoda.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ptlxxiwoda.exeC:\Users\Admin\AppData\Local\Temp\ptlxxiwoda.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\ptlxxiwoda.exeC:\Users\Admin\AppData\Local\Temp\ptlxxiwoda.exe update kodvadplxy.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kodvadplxy.exeC:\Users\Admin\AppData\Local\Temp\kodvadplxy.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\kodvadplxy.exeC:\Users\Admin\AppData\Local\Temp\kodvadplxy.exe update sxjelinidy.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sxjelinidy.exeC:\Users\Admin\AppData\Local\Temp\sxjelinidy.exe51⤵
-
C:\Users\Admin\AppData\Local\Temp\sxjelinidy.exeC:\Users\Admin\AppData\Local\Temp\sxjelinidy.exe update zugsaisgbv.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zugsaisgbv.exeC:\Users\Admin\AppData\Local\Temp\zugsaisgbv.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\zugsaisgbv.exeC:\Users\Admin\AppData\Local\Temp\zugsaisgbv.exe update onngutucbj.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\onngutucbj.exeC:\Users\Admin\AppData\Local\Temp\onngutucbj.exe53⤵
-
C:\Users\Admin\AppData\Local\Temp\onngutucbj.exeC:\Users\Admin\AppData\Local\Temp\onngutucbj.exe update ewlpfzshgk.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ewlpfzshgk.exeC:\Users\Admin\AppData\Local\Temp\ewlpfzshgk.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\ewlpfzshgk.exeC:\Users\Admin\AppData\Local\Temp\ewlpfzshgk.exe update brplsstwsy.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\brplsstwsy.exeC:\Users\Admin\AppData\Local\Temp\brplsstwsy.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\brplsstwsy.exeC:\Users\Admin\AppData\Local\Temp\brplsstwsy.exe update ebbjqdvclf.exe56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ebbjqdvclf.exeC:\Users\Admin\AppData\Local\Temp\ebbjqdvclf.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\ebbjqdvclf.exeC:\Users\Admin\AppData\Local\Temp\ebbjqdvclf.exe update mnnkjytgxh.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mnnkjytgxh.exeC:\Users\Admin\AppData\Local\Temp\mnnkjytgxh.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\mnnkjytgxh.exeC:\Users\Admin\AppData\Local\Temp\mnnkjytgxh.exe update uzieooutyd.exe58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uzieooutyd.exeC:\Users\Admin\AppData\Local\Temp\uzieooutyd.exe58⤵
-
C:\Users\Admin\AppData\Local\Temp\uzieooutyd.exeC:\Users\Admin\AppData\Local\Temp\uzieooutyd.exe update bbpfugbosp.exe59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bbpfugbosp.exeC:\Users\Admin\AppData\Local\Temp\bbpfugbosp.exe59⤵
-
C:\Users\Admin\AppData\Local\Temp\bbpfugbosp.exeC:\Users\Admin\AppData\Local\Temp\bbpfugbosp.exe update bfpznzajlb.exe60⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bfpznzajlb.exeC:\Users\Admin\AppData\Local\Temp\bfpznzajlb.exe60⤵
-
C:\Users\Admin\AppData\Local\Temp\bfpznzajlb.exeC:\Users\Admin\AppData\Local\Temp\bfpznzajlb.exe update tynxrtgmxj.exe61⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tynxrtgmxj.exeC:\Users\Admin\AppData\Local\Temp\tynxrtgmxj.exe61⤵
-
C:\Users\Admin\AppData\Local\Temp\tynxrtgmxj.exeC:\Users\Admin\AppData\Local\Temp\tynxrtgmxj.exe update qsslssmwxh.exe62⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
axtbhksoom.exe
cxiaxrjxtx.exe
dyptfsnudd.exe
frntccsgyd.exe
geolmjwueu.exe
hcjuvwqiaz.exe
hvurbwgfyy.exe
isussknply.exe
jjmxswsaop.exe
kfcrelolqc.exe
mheljujvey.exe
mnhkpxylnc.exe
qjmkhuvfiy.exe
rlpciklodu.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
yrhnybxbzf.exe
zazcfpyrxo.exe
zbvcknrmrc.exe
zdhkhrogki.exe
zvwtgypaod.exe
memory/420-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/420-26-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/892-45-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/984-314-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1132-101-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1136-65-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1420-137-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1552-359-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1592-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1592-10-0x0000000001000000-0x0000000001001000-memory.dmp
memory/1668-357-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1756-53-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1892-362-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2092-133-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2124-56-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2124-55-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/2236-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2236-15-0x0000000001030000-0x0000000001031000-memory.dmp
memory/2452-332-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2580-354-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2788-83-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3096-104-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3152-91-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3164-18-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/3164-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3324-352-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3508-68-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3832-303-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3936-7-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/3936-8-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4144-342-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4240-339-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4240-338-0x0000000001130000-0x0000000001131000-memory.dmp
memory/4360-296-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4416-73-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4440-76-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4512-329-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4804-348-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4980-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5060-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5060-0-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/5128-273-0x0000000001120000-0x0000000001121000-memory.dmp
memory/5128-274-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5316-85-0x0000000001040000-0x0000000001041000-memory.dmp
memory/5316-86-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5332-38-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5392-94-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5552-306-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5664-364-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5736-319-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5752-32-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5752-31-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/5844-48-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5896-311-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5928-2-0x0000000001160000-0x0000000001161000-memory.dmp
memory/5928-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5956-345-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/5956-346-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6064-322-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6084-140-0x000001C2001E0000-0x000001C2002E0000-memory.dmp
memory/6084-186-0x000001C214260000-0x000001C214280000-memory.dmp
memory/6084-149-0x000001C203ED0000-0x000001C203FD0000-memory.dmp
memory/6084-163-0x000001C203D20000-0x000001C203D40000-memory.dmp
memory/6084-148-0x000001C203C60000-0x000001C203C80000-memory.dmp