Analysis
- max time kernel
49s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 17:24
General
- Target 2026-07-08_91d4a8892e4e9a60c765900f8da651b2_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe
- Size 10.4MB
- Sample260708-vyr58adv2n
- SHA256 7fcdaf3829ad011d1bb4fa2c0c4bf76422d54237959b5b87103f39bbbc80cbb2
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 24 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 52 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_91d4a8892e4e9a60c765900f8da651b2_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_91d4a8892e4e9a60c765900f8da651b2_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_91d4a8892e4e9a60c765900f8da651b2_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exeC:\Users\Admin\AppData\Local\Temp\2026-07-08_91d4a8892e4e9a60c765900f8da651b2_amadey_coinminer_elex_emotet_remcos_smoke-loader_stop.exe update mgxiqlcipt.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mgxiqlcipt.exeC:\Users\Admin\AppData\Local\Temp\mgxiqlcipt.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mgxiqlcipt.exeC:\Users\Admin\AppData\Local\Temp\mgxiqlcipt.exe update xrxejvmuzj.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\xrxejvmuzj.exeC:\Users\Admin\AppData\Local\Temp\xrxejvmuzj.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xrxejvmuzj.exeC:\Users\Admin\AppData\Local\Temp\xrxejvmuzj.exe update odjemywomv.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\odjemywomv.exeC:\Users\Admin\AppData\Local\Temp\odjemywomv.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\odjemywomv.exeC:\Users\Admin\AppData\Local\Temp\odjemywomv.exe update ccuudxtxee.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ccuudxtxee.exeC:\Users\Admin\AppData\Local\Temp\ccuudxtxee.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ccuudxtxee.exeC:\Users\Admin\AppData\Local\Temp\ccuudxtxee.exe update ecxelyesuj.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ecxelyesuj.exeC:\Users\Admin\AppData\Local\Temp\ecxelyesuj.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ecxelyesuj.exeC:\Users\Admin\AppData\Local\Temp\ecxelyesuj.exe update pnkdfzaisa.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\pnkdfzaisa.exeC:\Users\Admin\AppData\Local\Temp\pnkdfzaisa.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pnkdfzaisa.exeC:\Users\Admin\AppData\Local\Temp\pnkdfzaisa.exe update juuqbceajn.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\juuqbceajn.exeC:\Users\Admin\AppData\Local\Temp\juuqbceajn.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\juuqbceajn.exeC:\Users\Admin\AppData\Local\Temp\juuqbceajn.exe update jvrsrnynhn.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\jvrsrnynhn.exeC:\Users\Admin\AppData\Local\Temp\jvrsrnynhn.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jvrsrnynhn.exeC:\Users\Admin\AppData\Local\Temp\jvrsrnynhn.exe update wufgwhdeig.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\wufgwhdeig.exeC:\Users\Admin\AppData\Local\Temp\wufgwhdeig.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wufgwhdeig.exeC:\Users\Admin\AppData\Local\Temp\wufgwhdeig.exe update dzlvudihse.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dzlvudihse.exeC:\Users\Admin\AppData\Local\Temp\dzlvudihse.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dzlvudihse.exeC:\Users\Admin\AppData\Local\Temp\dzlvudihse.exe update darcvwivkd.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\darcvwivkd.exeC:\Users\Admin\AppData\Local\Temp\darcvwivkd.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\darcvwivkd.exeC:\Users\Admin\AppData\Local\Temp\darcvwivkd.exe update tvihhqzeph.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\tvihhqzeph.exeC:\Users\Admin\AppData\Local\Temp\tvihhqzeph.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tvihhqzeph.exeC:\Users\Admin\AppData\Local\Temp\tvihhqzeph.exe update fmzgtbthlv.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\fmzgtbthlv.exeC:\Users\Admin\AppData\Local\Temp\fmzgtbthlv.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\fmzgtbthlv.exeC:\Users\Admin\AppData\Local\Temp\fmzgtbthlv.exe update nzvlkfiybx.exe15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exeC:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exeC:\Users\Admin\AppData\Local\Temp\nzvlkfiybx.exe update siwmxpmjok.exe16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\siwmxpmjok.exeC:\Users\Admin\AppData\Local\Temp\siwmxpmjok.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\siwmxpmjok.exeC:\Users\Admin\AppData\Local\Temp\siwmxpmjok.exe update sctthqvzjc.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sctthqvzjc.exeC:\Users\Admin\AppData\Local\Temp\sctthqvzjc.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\sctthqvzjc.exeC:\Users\Admin\AppData\Local\Temp\sctthqvzjc.exe update fyasxoyxmc.exe18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fyasxoyxmc.exeC:\Users\Admin\AppData\Local\Temp\fyasxoyxmc.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\fyasxoyxmc.exeC:\Users\Admin\AppData\Local\Temp\fyasxoyxmc.exe update cawoetuyxp.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cawoetuyxp.exeC:\Users\Admin\AppData\Local\Temp\cawoetuyxp.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\cawoetuyxp.exeC:\Users\Admin\AppData\Local\Temp\cawoetuyxp.exe update myneregjxt.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\myneregjxt.exeC:\Users\Admin\AppData\Local\Temp\myneregjxt.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\myneregjxt.exeC:\Users\Admin\AppData\Local\Temp\myneregjxt.exe update jdwamvhexi.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jdwamvhexi.exeC:\Users\Admin\AppData\Local\Temp\jdwamvhexi.exe21⤵
-
C:\Users\Admin\AppData\Local\Temp\jdwamvhexi.exeC:\Users\Admin\AppData\Local\Temp\jdwamvhexi.exe update jhrrvaxuvv.exe22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jhrrvaxuvv.exeC:\Users\Admin\AppData\Local\Temp\jhrrvaxuvv.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\jhrrvaxuvv.exeC:\Users\Admin\AppData\Local\Temp\jhrrvaxuvv.exe update wnvcuttqtw.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wnvcuttqtw.exeC:\Users\Admin\AppData\Local\Temp\wnvcuttqtw.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\wnvcuttqtw.exeC:\Users\Admin\AppData\Local\Temp\wnvcuttqtw.exe update jtqntdotrp.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jtqntdotrp.exeC:\Users\Admin\AppData\Local\Temp\jtqntdotrp.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\jtqntdotrp.exeC:\Users\Admin\AppData\Local\Temp\jtqntdotrp.exe update eddthmdovc.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\eddthmdovc.exeC:\Users\Admin\AppData\Local\Temp\eddthmdovc.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\eddthmdovc.exeC:\Users\Admin\AppData\Local\Temp\eddthmdovc.exe update ogubikyyrx.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ogubikyyrx.exeC:\Users\Admin\AppData\Local\Temp\ogubikyyrx.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\ogubikyyrx.exeC:\Users\Admin\AppData\Local\Temp\ogubikyyrx.exe update wsphpcexbq.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wsphpcexbq.exeC:\Users\Admin\AppData\Local\Temp\wsphpcexbq.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\wsphpcexbq.exeC:\Users\Admin\AppData\Local\Temp\wsphpcexbq.exe update ttjfqvtqdl.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ttjfqvtqdl.exeC:\Users\Admin\AppData\Local\Temp\ttjfqvtqdl.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\ttjfqvtqdl.exeC:\Users\Admin\AppData\Local\Temp\ttjfqvtqdl.exe update iksdwoofnn.exe29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iksdwoofnn.exeC:\Users\Admin\AppData\Local\Temp\iksdwoofnn.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\iksdwoofnn.exeC:\Users\Admin\AppData\Local\Temp\iksdwoofnn.exe update oikupehzuo.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oikupehzuo.exeC:\Users\Admin\AppData\Local\Temp\oikupehzuo.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\oikupehzuo.exeC:\Users\Admin\AppData\Local\Temp\oikupehzuo.exe update lvifkbvmjv.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lvifkbvmjv.exeC:\Users\Admin\AppData\Local\Temp\lvifkbvmjv.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\lvifkbvmjv.exeC:\Users\Admin\AppData\Local\Temp\lvifkbvmjv.exe update gflgncmxtj.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gflgncmxtj.exeC:\Users\Admin\AppData\Local\Temp\gflgncmxtj.exe32⤵
-
C:\Users\Admin\AppData\Local\Temp\gflgncmxtj.exeC:\Users\Admin\AppData\Local\Temp\gflgncmxtj.exe update vqtewsbodf.exe33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vqtewsbodf.exeC:\Users\Admin\AppData\Local\Temp\vqtewsbodf.exe33⤵
-
C:\Users\Admin\AppData\Local\Temp\vqtewsbodf.exeC:\Users\Admin\AppData\Local\Temp\vqtewsbodf.exe update itkwzysxtu.exe34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\itkwzysxtu.exeC:\Users\Admin\AppData\Local\Temp\itkwzysxtu.exe34⤵
-
C:\Users\Admin\AppData\Local\Temp\itkwzysxtu.exeC:\Users\Admin\AppData\Local\Temp\itkwzysxtu.exe update gvevoyldey.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gvevoyldey.exeC:\Users\Admin\AppData\Local\Temp\gvevoyldey.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\gvevoyldey.exeC:\Users\Admin\AppData\Local\Temp\gvevoyldey.exe update dwzlbdcmvm.exe36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exeC:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exeC:\Users\Admin\AppData\Local\Temp\dwzlbdcmvm.exe update iysrrcvsgq.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exeC:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exeC:\Users\Admin\AppData\Local\Temp\iysrrcvsgq.exe update livkatqyqg.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\livkatqyqg.exeC:\Users\Admin\AppData\Local\Temp\livkatqyqg.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\livkatqyqg.exeC:\Users\Admin\AppData\Local\Temp\livkatqyqg.exe update suogaojdik.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\suogaojdik.exeC:\Users\Admin\AppData\Local\Temp\suogaojdik.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\suogaojdik.exeC:\Users\Admin\AppData\Local\Temp\suogaojdik.exe update qsyrtpbjmk.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qsyrtpbjmk.exeC:\Users\Admin\AppData\Local\Temp\qsyrtpbjmk.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\qsyrtpbjmk.exeC:\Users\Admin\AppData\Local\Temp\qsyrtpbjmk.exe update iwvmgvsdxe.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iwvmgvsdxe.exeC:\Users\Admin\AppData\Local\Temp\iwvmgvsdxe.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\iwvmgvsdxe.exeC:\Users\Admin\AppData\Local\Temp\iwvmgvsdxe.exe update dkvdldvjwn.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dkvdldvjwn.exeC:\Users\Admin\AppData\Local\Temp\dkvdldvjwn.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\dkvdldvjwn.exeC:\Users\Admin\AppData\Local\Temp\dkvdldvjwn.exe update ksvmiuptce.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ksvmiuptce.exeC:\Users\Admin\AppData\Local\Temp\ksvmiuptce.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\ksvmiuptce.exeC:\Users\Admin\AppData\Local\Temp\ksvmiuptce.exe update nrvkjsnngs.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nrvkjsnngs.exeC:\Users\Admin\AppData\Local\Temp\nrvkjsnngs.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\nrvkjsnngs.exeC:\Users\Admin\AppData\Local\Temp\nrvkjsnngs.exe update smpbsmqkfq.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\smpbsmqkfq.exeC:\Users\Admin\AppData\Local\Temp\smpbsmqkfq.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\smpbsmqkfq.exeC:\Users\Admin\AppData\Local\Temp\smpbsmqkfq.exe update sqmenzdrpu.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sqmenzdrpu.exeC:\Users\Admin\AppData\Local\Temp\sqmenzdrpu.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\sqmenzdrpu.exeC:\Users\Admin\AppData\Local\Temp\sqmenzdrpu.exe update epqagwiebg.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\epqagwiebg.exeC:\Users\Admin\AppData\Local\Temp\epqagwiebg.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\epqagwiebg.exeC:\Users\Admin\AppData\Local\Temp\epqagwiebg.exe update xpnopdeqiv.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xpnopdeqiv.exeC:\Users\Admin\AppData\Local\Temp\xpnopdeqiv.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\xpnopdeqiv.exeC:\Users\Admin\AppData\Local\Temp\xpnopdeqiv.exe update xizkbsbhzx.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xizkbsbhzx.exeC:\Users\Admin\AppData\Local\Temp\xizkbsbhzx.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\xizkbsbhzx.exeC:\Users\Admin\AppData\Local\Temp\xizkbsbhzx.exe update efvslsbowv.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\efvslsbowv.exeC:\Users\Admin\AppData\Local\Temp\efvslsbowv.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\efvslsbowv.exeC:\Users\Admin\AppData\Local\Temp\efvslsbowv.exe update cazozmbcpj.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cazozmbcpj.exeC:\Users\Admin\AppData\Local\Temp\cazozmbcpj.exe51⤵
-
C:\Users\Admin\AppData\Local\Temp\cazozmbcpj.exeC:\Users\Admin\AppData\Local\Temp\cazozmbcpj.exe update sfukhfsfix.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exeC:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exeC:\Users\Admin\AppData\Local\Temp\sfukhfsfix.exe update ulkwhuuook.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exeC:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exe53⤵
-
C:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exeC:\Users\Admin\AppData\Local\Temp\ulkwhuuook.exe update hspfmzfsud.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hspfmzfsud.exeC:\Users\Admin\AppData\Local\Temp\hspfmzfsud.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\hspfmzfsud.exeC:\Users\Admin\AppData\Local\Temp\hspfmzfsud.exe update zailidcwab.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zailidcwab.exeC:\Users\Admin\AppData\Local\Temp\zailidcwab.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\zailidcwab.exeC:\Users\Admin\AppData\Local\Temp\zailidcwab.exe update mgmctovkab.exe56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mgmctovkab.exeC:\Users\Admin\AppData\Local\Temp\mgmctovkab.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\mgmctovkab.exeC:\Users\Admin\AppData\Local\Temp\mgmctovkab.exe update rltlrmcahc.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rltlrmcahc.exeC:\Users\Admin\AppData\Local\Temp\rltlrmcahc.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\rltlrmcahc.exeC:\Users\Admin\AppData\Local\Temp\rltlrmcahc.exe update rternqafma.exe58⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
cawoetuyxp.exe
ccuudxtxee.exe
darcvwivkd.exe
dzlvudihse.exe
ecxelyesuj.exe
fmzgtbthlv.exe
fyasxoyxmc.exe
juuqbceajn.exe
jvrsrnynhn.exe
mgxiqlcipt.exe
myneregjxt.exe
nzvlkfiybx.exe
odjemywomv.exe
pnkdfzaisa.exe
sctthqvzjc.exe
siwmxpmjok.exe
tvihhqzeph.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
update.exe
wufgwhdeig.exe
xrxejvmuzj.exe
memory/8-23-0x0000000001040000-0x0000000001041000-memory.dmp
memory/8-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/108-161-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/444-81-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/468-0-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/468-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/564-10-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/564-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/904-120-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/964-379-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1444-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1872-335-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1896-368-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1896-150-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1908-91-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2560-76-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2604-363-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2628-64-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2708-94-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2912-360-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2928-117-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3076-337-0x0000000001060000-0x0000000001061000-memory.dmp
memory/3076-338-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3132-101-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3132-100-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/3336-2-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/3336-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3408-84-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3484-15-0x00000000010F0000-0x00000000010F1000-memory.dmp
memory/3484-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3492-7-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/3492-8-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3536-205-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3900-44-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3900-43-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/3968-189-0x0000019983A80000-0x0000019983AA0000-memory.dmp
memory/3968-206-0x00000199952E0000-0x0000019995300000-memory.dmp
memory/3968-155-0x00000199801E0000-0x00000199802E0000-memory.dmp
memory/3968-174-0x0000019995000000-0x0000019995100000-memory.dmp
memory/3968-172-0x0000019983D10000-0x0000019983D30000-memory.dmp
memory/4192-146-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4232-50-0x0000000001000000-0x0000000001001000-memory.dmp
memory/4232-51-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4448-348-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4800-104-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4996-381-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5000-35-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5044-370-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5196-109-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5324-32-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5332-53-0x0000000001120000-0x0000000001121000-memory.dmp
memory/5332-54-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5332-375-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5340-345-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5468-373-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5532-61-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5556-112-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5744-40-0x0000000001030000-0x0000000001031000-memory.dmp
memory/5744-41-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5928-357-0x00000206B2000000-0x00000206B2691000-memory.dmp
memory/5928-377-0x00000206B2000000-0x00000206B2691000-memory.dmp
memory/5928-265-0x00000206B2000000-0x00000206B2691000-memory.dmp
memory/6016-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6100-71-0x0000000000400000-0x0000000000E90000-memory.dmp