Analysis
- max time kernel
28s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 00:28
General
- Target 2026-07-06_df7da6519554cee8101f8297f2f4f2fd_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
- Size 10.4MB
- Sample260707-ass54set9z
- SHA256 feeffef7cba0da9e9662118580a1ffad582e9383c94c1beeb5a22711649c3715
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 17 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 36 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_df7da6519554cee8101f8297f2f4f2fd_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_df7da6519554cee8101f8297f2f4f2fd_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_df7da6519554cee8101f8297f2f4f2fd_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_df7da6519554cee8101f8297f2f4f2fd_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update eeokihpggu.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\eeokihpggu.exeC:\Users\Admin\AppData\Local\Temp\eeokihpggu.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eeokihpggu.exeC:\Users\Admin\AppData\Local\Temp\eeokihpggu.exe update byudcobpay.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\byudcobpay.exeC:\Users\Admin\AppData\Local\Temp\byudcobpay.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\byudcobpay.exeC:\Users\Admin\AppData\Local\Temp\byudcobpay.exe update gwkkgyiopj.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\gwkkgyiopj.exeC:\Users\Admin\AppData\Local\Temp\gwkkgyiopj.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gwkkgyiopj.exeC:\Users\Admin\AppData\Local\Temp\gwkkgyiopj.exe update dyptfsnudd.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exeC:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exeC:\Users\Admin\AppData\Local\Temp\dyptfsnudd.exe update nkklboubhn.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\nkklboubhn.exeC:\Users\Admin\AppData\Local\Temp\nkklboubhn.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nkklboubhn.exeC:\Users\Admin\AppData\Local\Temp\nkklboubhn.exe update afepdpqlbl.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\afepdpqlbl.exeC:\Users\Admin\AppData\Local\Temp\afepdpqlbl.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\afepdpqlbl.exeC:\Users\Admin\AppData\Local\Temp\afepdpqlbl.exe update ydwbshkbdc.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ydwbshkbdc.exeC:\Users\Admin\AppData\Local\Temp\ydwbshkbdc.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ydwbshkbdc.exeC:\Users\Admin\AppData\Local\Temp\ydwbshkbdc.exe update qwflndvxbt.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\qwflndvxbt.exeC:\Users\Admin\AppData\Local\Temp\qwflndvxbt.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qwflndvxbt.exeC:\Users\Admin\AppData\Local\Temp\qwflndvxbt.exe update kvfdwmrekz.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\kvfdwmrekz.exeC:\Users\Admin\AppData\Local\Temp\kvfdwmrekz.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\kvfdwmrekz.exeC:\Users\Admin\AppData\Local\Temp\kvfdwmrekz.exe update dzhkugslxh.exe11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dzhkugslxh.exeC:\Users\Admin\AppData\Local\Temp\dzhkugslxh.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\dzhkugslxh.exeC:\Users\Admin\AppData\Local\Temp\dzhkugslxh.exe update sghjjwhuzx.exe12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sghjjwhuzx.exeC:\Users\Admin\AppData\Local\Temp\sghjjwhuzx.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\sghjjwhuzx.exeC:\Users\Admin\AppData\Local\Temp\sghjjwhuzx.exe update pbgbauemnn.exe13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pbgbauemnn.exeC:\Users\Admin\AppData\Local\Temp\pbgbauemnn.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\pbgbauemnn.exeC:\Users\Admin\AppData\Local\Temp\pbgbauemnn.exe update kpjvwvurqf.exe14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kpjvwvurqf.exeC:\Users\Admin\AppData\Local\Temp\kpjvwvurqf.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\kpjvwvurqf.exeC:\Users\Admin\AppData\Local\Temp\kpjvwvurqf.exe update bfdddxsbhe.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bfdddxsbhe.exeC:\Users\Admin\AppData\Local\Temp\bfdddxsbhe.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\bfdddxsbhe.exeC:\Users\Admin\AppData\Local\Temp\bfdddxsbhe.exe update oighvamzgr.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oighvamzgr.exeC:\Users\Admin\AppData\Local\Temp\oighvamzgr.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\oighvamzgr.exeC:\Users\Admin\AppData\Local\Temp\oighvamzgr.exe update eqllvymfrt.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\eqllvymfrt.exeC:\Users\Admin\AppData\Local\Temp\eqllvymfrt.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\eqllvymfrt.exeC:\Users\Admin\AppData\Local\Temp\eqllvymfrt.exe update betcbhcsuj.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\betcbhcsuj.exeC:\Users\Admin\AppData\Local\Temp\betcbhcsuj.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\betcbhcsuj.exeC:\Users\Admin\AppData\Local\Temp\betcbhcsuj.exe update gcvzqtbihq.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gcvzqtbihq.exeC:\Users\Admin\AppData\Local\Temp\gcvzqtbihq.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\gcvzqtbihq.exeC:\Users\Admin\AppData\Local\Temp\gcvzqtbihq.exe update gzsieewudx.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gzsieewudx.exeC:\Users\Admin\AppData\Local\Temp\gzsieewudx.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\gzsieewudx.exeC:\Users\Admin\AppData\Local\Temp\gzsieewudx.exe update tftwejocby.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tftwejocby.exeC:\Users\Admin\AppData\Local\Temp\tftwejocby.exe21⤵
-
C:\Users\Admin\AppData\Local\Temp\tftwejocby.exeC:\Users\Admin\AppData\Local\Temp\tftwejocby.exe update ouhtzmjqhy.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ouhtzmjqhy.exeC:\Users\Admin\AppData\Local\Temp\ouhtzmjqhy.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\ouhtzmjqhy.exeC:\Users\Admin\AppData\Local\Temp\ouhtzmjqhy.exe update twzlveeexe.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\twzlveeexe.exeC:\Users\Admin\AppData\Local\Temp\twzlveeexe.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\twzlveeexe.exeC:\Users\Admin\AppData\Local\Temp\twzlveeexe.exe update ocszvjpmnw.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ocszvjpmnw.exeC:\Users\Admin\AppData\Local\Temp\ocszvjpmnw.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\ocszvjpmnw.exeC:\Users\Admin\AppData\Local\Temp\ocszvjpmnw.exe update ggqhdngkqc.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ggqhdngkqc.exeC:\Users\Admin\AppData\Local\Temp\ggqhdngkqc.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\ggqhdngkqc.exeC:\Users\Admin\AppData\Local\Temp\ggqhdngkqc.exe update bbwigdwmcr.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bbwigdwmcr.exeC:\Users\Admin\AppData\Local\Temp\bbwigdwmcr.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\bbwigdwmcr.exeC:\Users\Admin\AppData\Local\Temp\bbwigdwmcr.exe update lexwtapost.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lexwtapost.exeC:\Users\Admin\AppData\Local\Temp\lexwtapost.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\lexwtapost.exeC:\Users\Admin\AppData\Local\Temp\lexwtapost.exe update sjrhqfhmna.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sjrhqfhmna.exeC:\Users\Admin\AppData\Local\Temp\sjrhqfhmna.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\sjrhqfhmna.exeC:\Users\Admin\AppData\Local\Temp\sjrhqfhmna.exe update vihhtrqqqe.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vihhtrqqqe.exeC:\Users\Admin\AppData\Local\Temp\vihhtrqqqe.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\vihhtrqqqe.exeC:\Users\Admin\AppData\Local\Temp\vihhtrqqqe.exe update tcfvgbzmuy.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tcfvgbzmuy.exeC:\Users\Admin\AppData\Local\Temp\tcfvgbzmuy.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\tcfvgbzmuy.exeC:\Users\Admin\AppData\Local\Temp\tcfvgbzmuy.exe update ayzydhrkpf.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ayzydhrkpf.exeC:\Users\Admin\AppData\Local\Temp\ayzydhrkpf.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\ayzydhrkpf.exeC:\Users\Admin\AppData\Local\Temp\ayzydhrkpf.exe update netershwti.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\netershwti.exeC:\Users\Admin\AppData\Local\Temp\netershwti.exe32⤵
-
C:\Users\Admin\AppData\Local\Temp\netershwti.exeC:\Users\Admin\AppData\Local\Temp\netershwti.exe update fttufhvujd.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fttufhvujd.exeC:\Users\Admin\AppData\Local\Temp\fttufhvujd.exe33⤵
-
C:\Users\Admin\AppData\Local\Temp\fttufhvujd.exeC:\Users\Admin\AppData\Local\Temp\fttufhvujd.exe update swknqondas.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\swknqondas.exeC:\Users\Admin\AppData\Local\Temp\swknqondas.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\swknqondas.exeC:\Users\Admin\AppData\Local\Temp\swknqondas.exe update ahudeciqxy.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ahudeciqxy.exeC:\Users\Admin\AppData\Local\Temp\ahudeciqxy.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\ahudeciqxy.exeC:\Users\Admin\AppData\Local\Temp\ahudeciqxy.exe update nvxwjzucpn.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nvxwjzucpn.exeC:\Users\Admin\AppData\Local\Temp\nvxwjzucpn.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\nvxwjzucpn.exeC:\Users\Admin\AppData\Local\Temp\nvxwjzucpn.exe update iqnpavhzgf.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iqnpavhzgf.exeC:\Users\Admin\AppData\Local\Temp\iqnpavhzgf.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\iqnpavhzgf.exeC:\Users\Admin\AppData\Local\Temp\iqnpavhzgf.exe update fkigvsgjxk.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fkigvsgjxk.exeC:\Users\Admin\AppData\Local\Temp\fkigvsgjxk.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\fkigvsgjxk.exeC:\Users\Admin\AppData\Local\Temp\fkigvsgjxk.exe update sykhhfvjpk.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sykhhfvjpk.exeC:\Users\Admin\AppData\Local\Temp\sykhhfvjpk.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\sykhhfvjpk.exeC:\Users\Admin\AppData\Local\Temp\sykhhfvjpk.exe update nxdfbwqiso.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nxdfbwqiso.exeC:\Users\Admin\AppData\Local\Temp\nxdfbwqiso.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\nxdfbwqiso.exeC:\Users\Admin\AppData\Local\Temp\nxdfbwqiso.exe update cuxvqqjtrd.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cuxvqqjtrd.exeC:\Users\Admin\AppData\Local\Temp\cuxvqqjtrd.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\cuxvqqjtrd.exeC:\Users\Admin\AppData\Local\Temp\cuxvqqjtrd.exe update mmvoceokad.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mmvoceokad.exeC:\Users\Admin\AppData\Local\Temp\mmvoceokad.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\mmvoceokad.exeC:\Users\Admin\AppData\Local\Temp\mmvoceokad.exe update pezuxtgans.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pezuxtgans.exeC:\Users\Admin\AppData\Local\Temp\pezuxtgans.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\pezuxtgans.exeC:\Users\Admin\AppData\Local\Temp\pezuxtgans.exe update zlmiyceokx.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zlmiyceokx.exeC:\Users\Admin\AppData\Local\Temp\zlmiyceokx.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\zlmiyceokx.exeC:\Users\Admin\AppData\Local\Temp\zlmiyceokx.exe update rpkwfvxzjk.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rpkwfvxzjk.exeC:\Users\Admin\AppData\Local\Temp\rpkwfvxzjk.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\rpkwfvxzjk.exeC:\Users\Admin\AppData\Local\Temp\rpkwfvxzjk.exe update rmiknoybhx.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rmiknoybhx.exeC:\Users\Admin\AppData\Local\Temp\rmiknoybhx.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\rmiknoybhx.exeC:\Users\Admin\AppData\Local\Temp\rmiknoybhx.exe update pgqoospfuj.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pgqoospfuj.exeC:\Users\Admin\AppData\Local\Temp\pgqoospfuj.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\pgqoospfuj.exeC:\Users\Admin\AppData\Local\Temp\pgqoospfuj.exe update mpjkagrdmv.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mpjkagrdmv.exeC:\Users\Admin\AppData\Local\Temp\mpjkagrdmv.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\mpjkagrdmv.exeC:\Users\Admin\AppData\Local\Temp\mpjkagrdmv.exe update ohiipttlyl.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ohiipttlyl.exeC:\Users\Admin\AppData\Local\Temp\ohiipttlyl.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\ohiipttlyl.exeC:\Users\Admin\AppData\Local\Temp\ohiipttlyl.exe update jhobxknfxw.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jhobxknfxw.exeC:\Users\Admin\AppData\Local\Temp\jhobxknfxw.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\jhobxknfxw.exeC:\Users\Admin\AppData\Local\Temp\jhobxknfxw.exe update yaupkupcpk.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\yaupkupcpk.exeC:\Users\Admin\AppData\Local\Temp\yaupkupcpk.exe51⤵
-
C:\Users\Admin\AppData\Local\Temp\yaupkupcpk.exeC:\Users\Admin\AppData\Local\Temp\yaupkupcpk.exe update ojbyvsnhck.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ojbyvsnhck.exeC:\Users\Admin\AppData\Local\Temp\ojbyvsnhck.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\ojbyvsnhck.exeC:\Users\Admin\AppData\Local\Temp\ojbyvsnhck.exe update mlxucfjanx.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mlxucfjanx.exeC:\Users\Admin\AppData\Local\Temp\mlxucfjanx.exe53⤵
-
C:\Users\Admin\AppData\Local\Temp\mlxucfjanx.exeC:\Users\Admin\AppData\Local\Temp\mlxucfjanx.exe update ozlnoofnni.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ozlnoofnni.exeC:\Users\Admin\AppData\Local\Temp\ozlnoofnni.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\ozlnoofnni.exeC:\Users\Admin\AppData\Local\Temp\ozlnoofnni.exe update wwqbkoklmx.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wwqbkoklmx.exeC:\Users\Admin\AppData\Local\Temp\wwqbkoklmx.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\wwqbkoklmx.exeC:\Users\Admin\AppData\Local\Temp\wwqbkoklmx.exe update bgixlqqwft.exe56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bgixlqqwft.exeC:\Users\Admin\AppData\Local\Temp\bgixlqqwft.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\bgixlqqwft.exeC:\Users\Admin\AppData\Local\Temp\bgixlqqwft.exe update ylrlghqrxr.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ylrlghqrxr.exeC:\Users\Admin\AppData\Local\Temp\ylrlghqrxr.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\ylrlghqrxr.exeC:\Users\Admin\AppData\Local\Temp\ylrlghqrxr.exe update wjjcrokler.exe58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wjjcrokler.exeC:\Users\Admin\AppData\Local\Temp\wjjcrokler.exe58⤵
-
C:\Users\Admin\AppData\Local\Temp\wjjcrokler.exeC:\Users\Admin\AppData\Local\Temp\wjjcrokler.exe update ldqwwhszqd.exe59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ldqwwhszqd.exeC:\Users\Admin\AppData\Local\Temp\ldqwwhszqd.exe59⤵
-
C:\Users\Admin\AppData\Local\Temp\ldqwwhszqd.exeC:\Users\Admin\AppData\Local\Temp\ldqwwhszqd.exe update ynhsmqcfjb.exe60⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ynhsmqcfjb.exeC:\Users\Admin\AppData\Local\Temp\ynhsmqcfjb.exe60⤵
-
C:\Users\Admin\AppData\Local\Temp\ynhsmqcfjb.exeC:\Users\Admin\AppData\Local\Temp\ynhsmqcfjb.exe update qgfyiszjek.exe61⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
afepdpqlbl.exe
betcbhcsuj.exe
bfdddxsbhe.exe
byudcobpay.exe
dyptfsnudd.exe
dzhkugslxh.exe
eeokihpggu.exe
eqllvymfrt.exe
gcvzqtbihq.exe
gwkkgyiopj.exe
kpjvwvurqf.exe
kvfdwmrekz.exe
nkklboubhn.exe
oighvamzgr.exe
pbgbauemnn.exe
qwflndvxbt.exe
sghjjwhuzx.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
ydwbshkbdc.exe
memory/416-339-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1148-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1148-26-0x0000000001000000-0x0000000001001000-memory.dmp
memory/1156-313-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1264-35-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1284-0-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1284-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1292-350-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1708-288-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1856-64-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1856-63-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/2176-352-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2264-54-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2264-53-0x0000000001130000-0x0000000001131000-memory.dmp
memory/2284-15-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/2284-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2432-43-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2512-310-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2608-278-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2612-336-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2648-61-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2648-60-0x0000000001160000-0x0000000001161000-memory.dmp
memory/2740-331-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2756-72-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2868-240-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3044-77-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3292-321-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4036-104-0x00000250801E0000-0x00000250802E0000-memory.dmp
memory/4036-111-0x0000025082E40000-0x0000025082F40000-memory.dmp
memory/4036-150-0x0000025094240000-0x0000025094260000-memory.dmp
memory/4036-109-0x0000025082A20000-0x0000025082A40000-memory.dmp
memory/4036-128-0x0000025082E00000-0x0000025082E20000-memory.dmp
memory/4128-368-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4216-318-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4228-80-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4228-79-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/4248-357-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4252-371-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4436-362-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4680-303-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4720-355-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4728-328-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4740-281-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4784-51-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4820-300-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4876-360-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4904-237-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4964-291-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4996-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4996-2-0x0000000001040000-0x0000000001041000-memory.dmp
memory/5040-366-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5064-8-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5064-7-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/5356-38-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5356-37-0x0000000001030000-0x0000000001031000-memory.dmp
memory/5372-373-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5372-46-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5416-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5416-10-0x0000000001120000-0x0000000001121000-memory.dmp
memory/5556-69-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5628-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5976-18-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/5976-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6108-344-0x0000000000400000-0x0000000000E90000-memory.dmp