Analysis
- max time kernel
68s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 16:14
General
- Target 2026-07-05_3e46615d4f926911ef1082cd5ab01451_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
- Size 10.6MB
- Sample260705-tpwllsdy5x
- SHA256 9e53754853f2bfe2b77f5c1b7ad39664a3b8e58cf016f87d73644919d5d812c5
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 44 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 46 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_3e46615d4f926911ef1082cd5ab01451_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_3e46615d4f926911ef1082cd5ab01451_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_3e46615d4f926911ef1082cd5ab01451_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exeC:\Users\Admin\AppData\Local\Temp\2026-07-05_3e46615d4f926911ef1082cd5ab01451_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update fgbngqqwlb.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\fgbngqqwlb.exeC:\Users\Admin\AppData\Local\Temp\fgbngqqwlb.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fgbngqqwlb.exeC:\Users\Admin\AppData\Local\Temp\fgbngqqwlb.exe update vtkjbhrjly.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vtkjbhrjly.exeC:\Users\Admin\AppData\Local\Temp\vtkjbhrjly.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vtkjbhrjly.exeC:\Users\Admin\AppData\Local\Temp\vtkjbhrjly.exe update xijamwxjls.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\xijamwxjls.exeC:\Users\Admin\AppData\Local\Temp\xijamwxjls.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xijamwxjls.exeC:\Users\Admin\AppData\Local\Temp\xijamwxjls.exe update xxqyobilyr.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\xxqyobilyr.exeC:\Users\Admin\AppData\Local\Temp\xxqyobilyr.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xxqyobilyr.exeC:\Users\Admin\AppData\Local\Temp\xxqyobilyr.exe update hffqutpuhw.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hffqutpuhw.exeC:\Users\Admin\AppData\Local\Temp\hffqutpuhw.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hffqutpuhw.exeC:\Users\Admin\AppData\Local\Temp\hffqutpuhw.exe update pnowfwymnw.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\pnowfwymnw.exeC:\Users\Admin\AppData\Local\Temp\pnowfwymnw.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pnowfwymnw.exeC:\Users\Admin\AppData\Local\Temp\pnowfwymnw.exe update zgxsaeivie.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\zgxsaeivie.exeC:\Users\Admin\AppData\Local\Temp\zgxsaeivie.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zgxsaeivie.exeC:\Users\Admin\AppData\Local\Temp\zgxsaeivie.exe update wiaraaboej.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\wiaraaboej.exeC:\Users\Admin\AppData\Local\Temp\wiaraaboej.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wiaraaboej.exeC:\Users\Admin\AppData\Local\Temp\wiaraaboej.exe update urwdntnyjj.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\urwdntnyjj.exeC:\Users\Admin\AppData\Local\Temp\urwdntnyjj.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\urwdntnyjj.exeC:\Users\Admin\AppData\Local\Temp\urwdntnyjj.exe update oijeszeowq.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\oijeszeowq.exeC:\Users\Admin\AppData\Local\Temp\oijeszeowq.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oijeszeowq.exeC:\Users\Admin\AppData\Local\Temp\oijeszeowq.exe update bpqtqmfsfz.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bpqtqmfsfz.exeC:\Users\Admin\AppData\Local\Temp\bpqtqmfsfz.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bpqtqmfsfz.exeC:\Users\Admin\AppData\Local\Temp\bpqtqmfsfz.exe update edehcggkcc.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\edehcggkcc.exeC:\Users\Admin\AppData\Local\Temp\edehcggkcc.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\edehcggkcc.exeC:\Users\Admin\AppData\Local\Temp\edehcggkcc.exe update vpkdabqkye.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vpkdabqkye.exeC:\Users\Admin\AppData\Local\Temp\vpkdabqkye.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vpkdabqkye.exeC:\Users\Admin\AppData\Local\Temp\vpkdabqkye.exe update tnfzqjlizb.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\tnfzqjlizb.exeC:\Users\Admin\AppData\Local\Temp\tnfzqjlizb.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tnfzqjlizb.exeC:\Users\Admin\AppData\Local\Temp\tnfzqjlizb.exe update bkmlsdxohi.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bkmlsdxohi.exeC:\Users\Admin\AppData\Local\Temp\bkmlsdxohi.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bkmlsdxohi.exeC:\Users\Admin\AppData\Local\Temp\bkmlsdxohi.exe update qmcfohjdmf.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\qmcfohjdmf.exeC:\Users\Admin\AppData\Local\Temp\qmcfohjdmf.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qmcfohjdmf.exeC:\Users\Admin\AppData\Local\Temp\qmcfohjdmf.exe update nrkujqkpeu.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\nrkujqkpeu.exeC:\Users\Admin\AppData\Local\Temp\nrkujqkpeu.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nrkujqkpeu.exeC:\Users\Admin\AppData\Local\Temp\nrkujqkpeu.exe update letqnhlkfs.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\letqnhlkfs.exeC:\Users\Admin\AppData\Local\Temp\letqnhlkfs.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\letqnhlkfs.exeC:\Users\Admin\AppData\Local\Temp\letqnhlkfs.exe update sjnjhexsgx.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\sjnjhexsgx.exeC:\Users\Admin\AppData\Local\Temp\sjnjhexsgx.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sjnjhexsgx.exeC:\Users\Admin\AppData\Local\Temp\sjnjhexsgx.exe update vfliygtcax.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\vfliygtcax.exeC:\Users\Admin\AppData\Local\Temp\vfliygtcax.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vfliygtcax.exeC:\Users\Admin\AppData\Local\Temp\vfliygtcax.exe update ixcnwztxqj.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ixcnwztxqj.exeC:\Users\Admin\AppData\Local\Temp\ixcnwztxqj.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ixcnwztxqj.exeC:\Users\Admin\AppData\Local\Temp\ixcnwztxqj.exe update fcsbyxqfqr.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\fcsbyxqfqr.exeC:\Users\Admin\AppData\Local\Temp\fcsbyxqfqr.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fcsbyxqfqr.exeC:\Users\Admin\AppData\Local\Temp\fcsbyxqfqr.exe update sbgcewliln.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\sbgcewliln.exeC:\Users\Admin\AppData\Local\Temp\sbgcewliln.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\sbgcewliln.exeC:\Users\Admin\AppData\Local\Temp\sbgcewliln.exe update faxoavbmvo.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\faxoavbmvo.exeC:\Users\Admin\AppData\Local\Temp\faxoavbmvo.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\faxoavbmvo.exeC:\Users\Admin\AppData\Local\Temp\faxoavbmvo.exe update zpofmkinva.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zpofmkinva.exeC:\Users\Admin\AppData\Local\Temp\zpofmkinva.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\zpofmkinva.exeC:\Users\Admin\AppData\Local\Temp\zpofmkinva.exe update frspslgsju.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\frspslgsju.exeC:\Users\Admin\AppData\Local\Temp\frspslgsju.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\frspslgsju.exeC:\Users\Admin\AppData\Local\Temp\frspslgsju.exe update hmgyjisqjf.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hmgyjisqjf.exeC:\Users\Admin\AppData\Local\Temp\hmgyjisqjf.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\hmgyjisqjf.exeC:\Users\Admin\AppData\Local\Temp\hmgyjisqjf.exe update mlwrodebhw.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mlwrodebhw.exeC:\Users\Admin\AppData\Local\Temp\mlwrodebhw.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\mlwrodebhw.exeC:\Users\Admin\AppData\Local\Temp\mlwrodebhw.exe update zvactzfdxo.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zvactzfdxo.exeC:\Users\Admin\AppData\Local\Temp\zvactzfdxo.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\zvactzfdxo.exeC:\Users\Admin\AppData\Local\Temp\zvactzfdxo.exe update zvnswbpvdd.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zvnswbpvdd.exeC:\Users\Admin\AppData\Local\Temp\zvnswbpvdd.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\zvnswbpvdd.exeC:\Users\Admin\AppData\Local\Temp\zvnswbpvdd.exe update oavbzdodas.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oavbzdodas.exeC:\Users\Admin\AppData\Local\Temp\oavbzdodas.exe32⤵
-
C:\Users\Admin\AppData\Local\Temp\oavbzdodas.exeC:\Users\Admin\AppData\Local\Temp\oavbzdodas.exe update harcplfqei.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\harcplfqei.exeC:\Users\Admin\AppData\Local\Temp\harcplfqei.exe33⤵
-
C:\Users\Admin\AppData\Local\Temp\harcplfqei.exeC:\Users\Admin\AppData\Local\Temp\harcplfqei.exe update wxesmfzbdx.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wxesmfzbdx.exeC:\Users\Admin\AppData\Local\Temp\wxesmfzbdx.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\wxesmfzbdx.exeC:\Users\Admin\AppData\Local\Temp\wxesmfzbdx.exe update drkogqbxul.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\drkogqbxul.exeC:\Users\Admin\AppData\Local\Temp\drkogqbxul.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\drkogqbxul.exeC:\Users\Admin\AppData\Local\Temp\drkogqbxul.exe update gnzzesaptm.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exeC:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exeC:\Users\Admin\AppData\Local\Temp\gnzzesaptm.exe update orvdyfnxmy.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\orvdyfnxmy.exeC:\Users\Admin\AppData\Local\Temp\orvdyfnxmy.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\orvdyfnxmy.exeC:\Users\Admin\AppData\Local\Temp\orvdyfnxmy.exe update bblhmtnurk.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bblhmtnurk.exeC:\Users\Admin\AppData\Local\Temp\bblhmtnurk.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\bblhmtnurk.exeC:\Users\Admin\AppData\Local\Temp\bblhmtnurk.exe update tqxnbjpwwz.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tqxnbjpwwz.exeC:\Users\Admin\AppData\Local\Temp\tqxnbjpwwz.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\tqxnbjpwwz.exeC:\Users\Admin\AppData\Local\Temp\tqxnbjpwwz.exe update dbmgtdphoj.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dbmgtdphoj.exeC:\Users\Admin\AppData\Local\Temp\dbmgtdphoj.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\dbmgtdphoj.exeC:\Users\Admin\AppData\Local\Temp\dbmgtdphoj.exe update wnuzypkohl.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wnuzypkohl.exeC:\Users\Admin\AppData\Local\Temp\wnuzypkohl.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\wnuzypkohl.exeC:\Users\Admin\AppData\Local\Temp\wnuzypkohl.exe update bhqdtjkdtz.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bhqdtjkdtz.exeC:\Users\Admin\AppData\Local\Temp\bhqdtjkdtz.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\bhqdtjkdtz.exeC:\Users\Admin\AppData\Local\Temp\bhqdtjkdtz.exe update lvdwgrnqsk.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exeC:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exeC:\Users\Admin\AppData\Local\Temp\lvdwgrnqsk.exe update dslvhfqkfj.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exeC:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exeC:\Users\Admin\AppData\Local\Temp\dslvhfqkfj.exe update lexwtapost.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lexwtapost.exeC:\Users\Admin\AppData\Local\Temp\lexwtapost.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\lexwtapost.exeC:\Users\Admin\AppData\Local\Temp\lexwtapost.exe update kxtpsbtnkf.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kxtpsbtnkf.exeC:\Users\Admin\AppData\Local\Temp\kxtpsbtnkf.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\kxtpsbtnkf.exeC:\Users\Admin\AppData\Local\Temp\kxtpsbtnkf.exe update lusrlbspdq.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lusrlbspdq.exeC:\Users\Admin\AppData\Local\Temp\lusrlbspdq.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\lusrlbspdq.exeC:\Users\Admin\AppData\Local\Temp\lusrlbspdq.exe update vjncmrrild.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vjncmrrild.exeC:\Users\Admin\AppData\Local\Temp\vjncmrrild.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\vjncmrrild.exeC:\Users\Admin\AppData\Local\Temp\vjncmrrild.exe update xbpgaselyk.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xbpgaselyk.exeC:\Users\Admin\AppData\Local\Temp\xbpgaselyk.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\xbpgaselyk.exeC:\Users\Admin\AppData\Local\Temp\xbpgaselyk.exe update klguibosri.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\klguibosri.exeC:\Users\Admin\AppData\Local\Temp\klguibosri.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\klguibosri.exeC:\Users\Admin\AppData\Local\Temp\klguibosri.exe update prvqrylarp.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\prvqrylarp.exeC:\Users\Admin\AppData\Local\Temp\prvqrylarp.exe51⤵
-
C:\Users\Admin\AppData\Local\Temp\prvqrylarp.exeC:\Users\Admin\AppData\Local\Temp\prvqrylarp.exe update hzgxnvqxxo.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hzgxnvqxxo.exeC:\Users\Admin\AppData\Local\Temp\hzgxnvqxxo.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\hzgxnvqxxo.exeC:\Users\Admin\AppData\Local\Temp\hzgxnvqxxo.exe update ufjimomavh.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ufjimomavh.exeC:\Users\Admin\AppData\Local\Temp\ufjimomavh.exe53⤵
-
C:\Users\Admin\AppData\Local\Temp\ufjimomavh.exeC:\Users\Admin\AppData\Local\Temp\ufjimomavh.exe update mxigqiswpp.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mxigqiswpp.exeC:\Users\Admin\AppData\Local\Temp\mxigqiswpp.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\mxigqiswpp.exeC:\Users\Admin\AppData\Local\Temp\mxigqiswpp.exe update xblfuhqyjz.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xblfuhqyjz.exeC:\Users\Admin\AppData\Local\Temp\xblfuhqyjz.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\xblfuhqyjz.exeC:\Users\Admin\AppData\Local\Temp\xblfuhqyjz.exe update endbijvxbm.exe56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\endbijvxbm.exeC:\Users\Admin\AppData\Local\Temp\endbijvxbm.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\endbijvxbm.exeC:\Users\Admin\AppData\Local\Temp\endbijvxbm.exe update hbsmolmqan.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hbsmolmqan.exeC:\Users\Admin\AppData\Local\Temp\hbsmolmqan.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\hbsmolmqan.exeC:\Users\Admin\AppData\Local\Temp\hbsmolmqan.exe update jbuqcealnm.exe58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jbuqcealnm.exeC:\Users\Admin\AppData\Local\Temp\jbuqcealnm.exe58⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
bkmlsdxohi.exe
bpqtqmfsfz.exe
edehcggkcc.exe
fgbngqqwlb.exe
hffqutpuhw.exe
ixcnwztxqj.exe
letqnhlkfs.exe
nrkujqkpeu.exe
oijeszeowq.exe
pnowfwymnw.exe
qmcfohjdmf.exe
sjnjhexsgx.exe
tnfzqjlizb.exe
update.exe
update.exe
update.exe
update.exe
urwdntnyjj.exe
vfliygtcax.exe
vpkdabqkye.exe
vtkjbhrjly.exe
wiaraaboej.exe
xijamwxjls.exe
xxqyobilyr.exe
zgxsaeivie.exe
memory/124-117-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/552-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/552-181-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/552-2-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/1080-7-0x0000000001160000-0x0000000001161000-memory.dmp
memory/1080-8-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1176-41-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1176-40-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/1356-186-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1428-35-0x0000000001030000-0x0000000001031000-memory.dmp
memory/1428-36-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1680-184-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2064-62-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2064-61-0x0000000001000000-0x0000000001001000-memory.dmp
memory/2240-157-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2388-83-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2484-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2484-0-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/2516-33-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2544-209-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2588-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2592-220-0x00000160001E0000-0x00000160002E0000-memory.dmp
memory/2680-136-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2696-86-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2792-120-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2868-152-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2892-78-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2896-128-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2924-211-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3128-174-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3140-162-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3304-125-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3304-124-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/3340-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3432-170-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3436-112-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3760-10-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/3760-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3872-215-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4144-91-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4156-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4224-59-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4468-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4468-26-0x0000000001120000-0x0000000001121000-memory.dmp
memory/4960-99-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5040-167-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5336-48-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/5336-49-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5416-109-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5692-149-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5712-176-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5744-74-0x0000000001040000-0x0000000001041000-memory.dmp
memory/5744-75-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5752-94-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5760-179-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5884-67-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5920-44-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5968-70-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6004-52-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6040-133-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6068-144-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6088-141-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6088-140-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/6124-102-0x0000000000400000-0x0000000000E90000-memory.dmp