remus_stealer | 62788f537c614d414fdd16496caf68ad89a62ff72086524cedecb4f4a6700e2a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Size 170KB
Sample260630-rskbmsg12w
SHA256 62788f537c614d414fdd16496caf68ad89a62ff72086524cedecb4f4a6700e2a
MD5 b9192029147e79aee2f2bd102fa316e8
SHA1 10a03c47df54bf736d873255cd54acb9ada93ec8
SHA512 100bf87a5803020a8d55f5219e9d77a960908d4bcf89c02810f8d69ec6d27c492072c9748c7cb53c045863935b6311d6f5a9a984932df0d1240bb7c828f4803f
SSDEEP 3072:f8DzRXbBs5vTOv3T7OjVx4rItkSF0JZGe+rP/lOAg0FuD0k2jIkcVt:EDNUToT4ssmSaJZ4MAOJ2j3W
TLSH
T131047B10B5E2C4B2EA77057008F89B75597DBC310F214AFB67D80B7E4E342D19A35ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery remus_stealer persistence stealer

Malware Config

Extracted

Family

remus_stealer

http://myrtler.biz:9549
http://carogra.biz:4219
http://youngel.biz:8768

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/2988-11-0x000002026DFF0000-0x000002026DFF3000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c509-45.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c509-45.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c50b-53.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	3040	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	WinSysKdrv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	WinSysKdrv.exe

Executes dropped EXE 9 IoCs

pid	Process
1840	dl_240675500_0.exe
4512	ujedirez.exe
2380	winhost.exe
1660	dl_240684578_1.exe
4528	WinSysKdrv.exe
3644	EmbeddedDriverService.sys
5800	yzefetgl.exe
5476	WinSysKdrv.exe
3600	ypsjelwb.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\Y:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\A:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\J:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\L:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\N:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\R:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\V:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\H:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\K:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\O:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\P:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\B:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\D:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\I:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\S:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\G:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\M:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\T:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\U:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
File opened (read-only)	\??\W:	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 4772	4512	ujedirez.exe	90
PID 3600 set thread context of 2540	3600	ypsjelwb.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	dl_240675500_0.exe
1840	dl_240675500_0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3496	Explorer.EXE

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
4528	WinSysKdrv.exe
4528	WinSysKdrv.exe
5476	WinSysKdrv.exe
5476	WinSysKdrv.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4512	ujedirez.exe
3600	ypsjelwb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeShutdownPrivilege	3496	Explorer.EXE
Token: SeCreatePagefilePrivilege	3496	Explorer.EXE
Token: SeLoadDriverPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe
Token: SeDebugPrivilege	4528	WinSysKdrv.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1840	3040	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe	88
PID 1840 wrote to memory of 2988	1840	dl_240675500_0.exe	45
PID 1840 wrote to memory of 3496	1840	dl_240675500_0.exe	51
PID 1840 wrote to memory of 4424	1840	dl_240675500_0.exe	63
PID 1840 wrote to memory of 4484	1840	dl_240675500_0.exe	64
PID 1840 wrote to memory of 4512	1840	dl_240675500_0.exe	89
PID 4512 wrote to memory of 4772	4512	ujedirez.exe	90
PID 3496 wrote to memory of 4480	3496	Explorer.EXE
PID 3040 wrote to memory of 1660	3040	2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe	93
PID 3496 wrote to memory of 5128	3496	Explorer.EXE
PID 1840 wrote to memory of 5800	1840	dl_240675500_0.exe	100
PID 1840 wrote to memory of 3600	1840	dl_240675500_0.exe	103
PID 3600 wrote to memory of 2540	3600	ypsjelwb.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2988

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_b9192029147e79aee2f2bd102fa316e8_amadey_cobalt-strike_elex_hellokitty_smoke-loader.exe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Downloads MZ/PE file
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\dl_240675500_0.exe
    "C:\Users\Admin\AppData\Local\Temp\dl_240675500_0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\ujedirez.exe
      "C:\Users\Admin\AppData\Local\Temp\ujedirez.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Windows\system32\notepad.exe
        
        C:\Windows\system32\notepad.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\yzefetgl.exe
      "C:\Users\Admin\AppData\Local\Temp\yzefetgl.exe"
      4⤵
      Executes dropped EXE
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\ypsjelwb.exe
      "C:\Users\Admin\AppData\Local\Temp\ypsjelwb.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Windows\system32\notepad.exe
        
        C:\Windows\system32\notepad.exe
        5⤵
        
        PID:2540
- - C:\Users\Admin\AppData\Local\Temp\dl_240684578_1.exe
    "C:\Users\Admin\AppData\Local\Temp\dl_240684578_1.exe"
    3⤵
    - Executes dropped EXE
    PID:1660

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:3644

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSysKdrv.exe

Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
Size 147KB
SHA256 be495b5cd25cba230cc88aa99d34f2f7b70201b7047ae7a605950756acce215c
MD5 e57325406173324144960bbafbad6a11
SHA1 f9fde8480bb883016207f154dd473e56d629b36f
SHA512 fd0ed85d29948c512cb072f13d2046677318dc4af588a1b7507adb538cc0227bb00634204feacb7840f0e3fc21b26074b6dda61d1737156e38ea41f918719686
SSDEEP 3072:zEM70gfA56h/elpYxyB+yLgFeOWX+LIbnZz8EN9lDt:/xf7rxyBNdOfUHJ
TLSH
T10CE35A4363E920E5F1778638C9A58646EB71B8320720ABEF07A0465A5F237D1ED3DB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dl_240675500_0.exe

Path C:\Users\Admin\AppData\Local\Temp\dl_240675500_0.exe
Size 46KB
SHA256 bdc4b2c8b13f3db22761c731839f71500ce440b187b2fdce7a5cc87e6ff45913
MD5 c5f4c7003b0c2fd17c429686858a397e
SHA1 f4c5b7bf49963fc55dceec785fcdecda8e3f6206
SHA512 419d224ff267749ecf48e0e376a7831048243238e39da55dfdeaf0594c9f41fbd87d56cc546f7fedde9c58e910ae9049f68ed4537a86cb7f64782959c8e09bd4
SSDEEP 768:9DZC/PlRFd1usW38oVfcLRpOz0xiTqm4icapusn9mbUNbKEt0lyaEuQlEznC7:1IlHd1ZWXVELRtxzmhcapRn9eceEt0lQ
TLSH
T1EF235C2D53DA018ED8728630CA696737D972B342B238256F07F0E92F6F2AD357134927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dl_240684578_1.exe

Path C:\Users\Admin\AppData\Local\Temp\dl_240684578_1.exe
Size 265KB
SHA256 a09b8f3482137394a421f6a96eaa3664f468ddfbcdf01651dae8fc0898e9a13e
MD5 b31e9f2479f734538e6a378656f05ceb
SHA1 1a716ea4ead1f0bb4110689494fa6fef7dc3cfad
SHA512 32ea8aae9f44b49511ab02abfce662fd7eebb0c5d9ceb6f2ec652279f3185d1403e189d98f6502ec0780372b704c1a6401d6cc6f9a6ea490fc5534b75006250f
SSDEEP 6144:FJHTrrdy4gptRY/6l6Zaoxf7rxyBNdOfUHJF:FJf5c2SlI5xfMBNA
TLSH
T1F3447C4663E524F9E0B78238C9A54B46E771F8621330ABDF07A0865E1F233D1AD39B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujedirez.exe

Path C:\Users\Admin\AppData\Local\Temp\ujedirez.exe
Size 319KB
SHA256 bfba9ffd723cb8aba936c02db11d71aa37838efac3ef258b9e97180c49577eaa
MD5 1f0924fefc5e5b945bade42870df13e1
SHA1 c22a5ed2d7b09ec8981563a0a8a477b9feb4918f
SHA512 652bf1965326cbe718b9f1af63404239d70f4db27f2e56f64e77812ea1dff41578f4356e4d554f3cdf8d26abfcf78ef67f2031cb690ce2cdf9e67d173834dc76
SSDEEP 6144:JrkejPzxtdQQPduBjAfokhPYJJuMjBUnm3XfMmuXz:5kQ9wBjqSJsMtT/MHj
TLSH
T1CD64F16B73AA30F8D1F78A3984A50518D362FC361B619BEF07A142522F272D54D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desktop - Files.lnk

Path C:\Users\Admin\Desktop\Desktop - Files.lnk
Size 572B
SHA256 c67bad2c5bc848f09441b12762dfc1905f60b59f19ce670d0bc0972e8158cfa0
MD5 e037712463c8d3c3d041171f8e978279
SHA1 edfbbdd511106f5275cdc1d81fe8d2553dfee5a3
SHA512 7ca83490784b2f6410960fa4eb666a1208f90dc22078d68c2d3440ced6d728f8a712cb44483d4d023cfa3db5da892e0c6517d489d365a48a1a09ab8b3ef07f34
TLSH
T156F09E9B13C34A77C22380B58C35435A8236BD165A65C60DCE84C15E6C813818468FD7
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop - Files.lnk

Path C:\Users\Admin\Desktop\Desktop - Files.lnk
Size 1KB
SHA256 ad2192c28af6f2788bf37d2b02d44713587232444573bbcdcda06d8c9b813b51
MD5 2f40e1f7ea077253213084fd13cc1a7a
SHA1 8e11e49539231876018777d409780773022f0441
SHA512 81d8016c7087f29b42d24a9d4920b858bf92aebd1abb0585a9760a1594c3bfb935f48d1cd9cce01a2045b546ba8b90fb418a6b8ea108f642d4bcfc7edd1c8720
TLSH
T1D221AC1A6AE30772F036D970BCF1569A9234B9D13B46EA0D43C0820D0872B82BE52F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.lnk

Path C:\Users\Admin\Desktop\Downloads.lnk
Size 761B
SHA256 2f54d7cd43c418b92347c53bfbdd2b2e94c7c6918f0e97c3e5600580c4e7efba
MD5 d8a94c471722f95167ba9979ba622a9b
SHA1 646b98a6951c79dadc2bdaf39f424a9e992dc7be
SHA512 0f68b2411c5ec1760a6c12d1d5e1b48a2906cc76a5ed994f9f1333f7e905401e88f7f5c5c031731a2b1547d919ada0748a1ea54ba9ff211ee42f0e204f7da27a
TLSH
T1D001DD8E22C34762C225D03DCD380657D225F8137A569F9D8FD1D3891C95283D499DDF
MD5 SHA1 SHA512 TLSH

Submit Download

My Documents.lnk

Path C:\Users\Admin\Desktop\My Documents.lnk
Size 761B
SHA256 563869e2ae75b514f6a4490f06b9cce75e6aa61ba7642d9c17f6ad009d23cd7e
MD5 970a1fc97dfb478fd8d905de82b5840f
SHA1 1256272f134055884ed6ca1ea911f71dedda4d08
SHA512 36a64f3b722088ebe0499caca8dbfa708a951b5028942aa8c2b3a8177988aa46a9d36bdf98152c07683cb81c760e7b3cdaa3c537f9b63fee1fc31477a434f710
TLSH
T15C01DD8E22C34762C225D43DCC380757D225F8137A969F9D8ED1D3891C95283D489DDF
MD5 SHA1 SHA512 TLSH

Submit Download

Shared Photos.lnk

Path C:\Users\Admin\Desktop\Shared Photos.lnk
Size 761B
SHA256 3ca9e8f5f74ecf050992f4a47f86e65a103114e0b59f853a32eb1199a0b84905
MD5 8358119d5d1e2e770ddf9fcaf690d094
SHA1 f93490b7d2fe07a54883cc73d916afc6cc79e9b5
SHA512 6bb8f7c9049d9d0ba361aaae24b43a2e5510e9366a6ad30263ad4548c3fc6160100a9a22e288a29146609560b90156281d3cf03ca693e2d8d11d23f215e4146a
TLSH
T12D01DD8E22C34762C225D03DCC3806579225F8137A569E9E8ED1D3895C95283E489DDF
MD5 SHA1 SHA512 TLSH

Submit Download

Work Files.lnk

Path C:\Users\Admin\Desktop\Work Files.lnk
Size 761B
SHA256 23fc5f201f14e829588337a5765c0a321708544ba2095ca3b844bf2ac7a99ceb
MD5 ba8b2988a08a28938f1ee644b059011d
SHA1 a9d0742229a4a50b8c6f36e23881e94e0d749159
SHA512 9ed426c6649d7f00b7d01f45287a1ddc7f7a7fd9b2e2a05704fcc1f9bcf8a221533248156108b2094ae853c7fad04494e0be6f81a59fec40970cd2aa5fa2bf65
TLSH
T1FB01DD8E22C34762C225D03DCC3806679225F8137A569E9E8ED1D3891C95283D489DDF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1840-10-0x00007FFD49C60000-0x00007FFD49EC3000-memory.dmp

Download

memory/2380-38-0x00007FFD49C60000-0x00007FFD49EC3000-memory.dmp

Download

memory/2988-17-0x0000020270B30000-0x0000020270B37000-memory.dmp

Download

memory/2988-40-0x0000020270B30000-0x0000020270B37000-memory.dmp

Download

memory/2988-11-0x000002026DFF0000-0x000002026DFF3000-memory.dmp

Download

memory/2988-20-0x0000020270B30000-0x0000020270B37000-memory.dmp

Download

memory/3496-19-0x0000000003C70000-0x0000000003C77000-memory.dmp

Download

memory/3496-13-0x0000000003C70000-0x0000000003C77000-memory.dmp

Download

memory/3496-68-0x0000000003C50000-0x0000000003C51000-memory.dmp

Download

memory/3496-36-0x0000000003C90000-0x0000000003C91000-memory.dmp

Download

memory/4424-75-0x000001F301C40000-0x000001F301C47000-memory.dmp

Download

memory/4424-21-0x000001F301C40000-0x000001F301C47000-memory.dmp

Download

memory/4424-25-0x000001F301C40000-0x000001F301C47000-memory.dmp

Download

memory/4484-26-0x00000230EFA20000-0x00000230EFA27000-memory.dmp

Download

memory/4484-23-0x00000230EFA20000-0x00000230EFA27000-memory.dmp

Download

memory/4484-76-0x00000230EFA20000-0x00000230EFA27000-memory.dmp

Download

memory/4772-35-0x0000000140000000-0x000000014003A000-memory.dmp

Download