Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 23:22
General
- Target inst_smt008.exe
- Size 55.2MB
- Sample260804-3cwwaaac46
- SHA256 e0774962ada6a10240b5fb28a235c399ca86d8afe5e903f930db54d91d976d57
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Indicator Removal: Clear Persistence 1 TTPs 3 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\kpmhJn\snK0cQ.exeC:\Users\Public\kpmhJn\snK0cQ.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\kpmhJn\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\kpmhJn\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵
-
-
-
C:\Users\Public\kpmhJn\snK0cQ.exe"C:\Users\Public\kpmhJn\snK0cQ.exe"1⤵
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\kpmhJn" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\kpmhJn" /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\cmd.execmd.exe1⤵
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
UxEnhance64.dll
adoresd.dat
msadox.tb
snK0cQ.exe
memory/220-546-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-558-0x00000194EE1A0000-0x00000194EE22A000-memory.dmp
memory/220-566-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-556-0x00000194ECE00000-0x00000194ECE4E000-memory.dmp
memory/220-557-0x00000194EE1A0000-0x00000194EE22A000-memory.dmp
memory/220-531-0x00007FFFEE2D0000-0x00007FFFEE2D2000-memory.dmp
memory/220-565-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-532-0x00007FFFCF870000-0x00007FFFCFD8E000-memory.dmp
memory/220-537-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-560-0x00000194EE1A0000-0x00000194EE22A000-memory.dmp
memory/220-540-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-539-0x00007FFFEE2E0000-0x00007FFFEE2E2000-memory.dmp
memory/220-545-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-544-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-559-0x00000194EE1A0000-0x00000194EE22A000-memory.dmp
memory/220-547-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/220-551-0x00000194ED870000-0x00000194EE101000-memory.dmp
memory/3612-574-0x000002319CA10000-0x000002319D2A1000-memory.dmp
memory/3612-576-0x00007FFFEE2E0000-0x00007FFFEE2E2000-memory.dmp
memory/3612-585-0x00007FFFEE2D0000-0x00007FFFEE2D2000-memory.dmp
memory/3612-584-0x000002319CA10000-0x000002319D2A1000-memory.dmp
memory/3612-583-0x000002319CA10000-0x000002319D2A1000-memory.dmp
memory/3612-582-0x000002319CA10000-0x000002319D2A1000-memory.dmp
memory/3612-581-0x000002319CA10000-0x000002319D2A1000-memory.dmp
memory/3612-571-0x00007FFFCF870000-0x00007FFFCFD8E000-memory.dmp
memory/3612-577-0x000002319CA10000-0x000002319D2A1000-memory.dmp
memory/4140-525-0x00000000001E0000-0x00000000001ED000-memory.dmp
memory/4140-0-0x00000000001E0000-0x00000000001ED000-memory.dmp
memory/4140-526-0x00007FFFE8C30000-0x00007FFFE8C40000-memory.dmp
memory/4140-514-0x00007FFFE8C30000-0x00007FFFE8C40000-memory.dmp
memory/4140-504-0x00007FFFE8C30000-0x00007FFFE8C40000-memory.dmp
memory/4140-2-0x00000000001F0000-0x00000000001FB000-memory.dmp
memory/4140-1-0x00000000001E0000-0x00000000001ED000-memory.dmp