88e503bf4f6d3b4e855bba0b6774cb39b4996610165b7017b884bd6fde94e2df

Analysis

max time kernel
137s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
Size 1.2MB
Sample260806-2p23dsscjf
SHA256 88e503bf4f6d3b4e855bba0b6774cb39b4996610165b7017b884bd6fde94e2df
MD5 a70d9e4522c3273a8ad99dfaafc1ab26
SHA1 a9597cbe3304be8785d49f4b5a78c7b4fcda3153
SHA512 f5c67de1bb46cd12fa44a8edb8c2e8c18bf9361a469f4cc4207a4af3abff55b97a33286e899df9404cdbd6cac4da12f4fe0375d2ba2bba7a9c95ab4091ef0e78
SSDEEP 24576:I/0/wH2fMinErsWguWHbL7pYcVX6u5MSZgEwYpkhj9thjtfHQpxhwc:1W2frO1fW7L7pPVqu5MSZqd9tHfHQpxv
TLSH
T125452363B455D431E0222830D476E2F18279B532AA7594CF6BAAC7FD9E327C0DA74723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	QUXadhkn.exe

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	QUXadhkn.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	QUXadhkn.exe

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001c4c8-3.dat	UPX
behavioral2/memory/3344-4-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-27-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-28-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-40-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-42-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-43-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-46-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-51-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-53-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX
behavioral2/memory/3344-60-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	QUXadhkn.exe

Executes dropped EXE 1 IoCs

pid	Process
3344	QUXadhkn.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Zdel2025 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QUXadhkn.exe /desktop2"	QUXadhkn.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	QUXadhkn.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	QUXadhkn.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	QUXadhkn.exe
File opened (read-only)	\??\h:	QUXadhkn.exe
File opened (read-only)	\??\n:	QUXadhkn.exe
File opened (read-only)	\??\o:	QUXadhkn.exe
File opened (read-only)	\??\q:	QUXadhkn.exe
File opened (read-only)	\??\x:	QUXadhkn.exe
File opened (read-only)	\??\y:	QUXadhkn.exe
File opened (read-only)	\??\g:	QUXadhkn.exe
File opened (read-only)	\??\m:	QUXadhkn.exe
File opened (read-only)	\??\w:	QUXadhkn.exe
File opened (read-only)	\??\z:	QUXadhkn.exe
File opened (read-only)	\??\b:	QUXadhkn.exe
File opened (read-only)	\??\l:	QUXadhkn.exe
File opened (read-only)	\??\p:	QUXadhkn.exe
File opened (read-only)	\??\s:	QUXadhkn.exe
File opened (read-only)	\??\t:	QUXadhkn.exe
File opened (read-only)	\??\v:	QUXadhkn.exe
File opened (read-only)	\??\a:	QUXadhkn.exe
File opened (read-only)	\??\i:	QUXadhkn.exe
File opened (read-only)	\??\j:	QUXadhkn.exe
File opened (read-only)	\??\k:	QUXadhkn.exe
File opened (read-only)	\??\r:	QUXadhkn.exe
File opened (read-only)	\??\u:	QUXadhkn.exe

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4800	cmd.exe
1744	cmd.exe
6044	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3344-27-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-28-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-40-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-42-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-43-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-46-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-51-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-53-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe
behavioral2/memory/3344-60-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\bdpic.ico	QUXadhkn.exe
File opened for modification	C:\Windows\system32\Qdpd2881.dll	QUXadhkn.exe
File opened for modification	C:\Windows\system32\LeaveExit.log	QUXadhkn.exe
File opened for modification	C:\Windows\System32\LeaveExit.log	QUXadhkn.exe
File created	C:\Windows\System32\bdpic.ico	QUXadhkn.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001c00000001c4c8-3.dat	upx
behavioral2/memory/3344-4-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-27-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-28-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-40-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-42-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-43-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-46-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-51-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-53-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx
behavioral2/memory/3344-60-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp	upx

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Vss	QUXadhkn.exe
File opened for modification	C:\Windows\Web	QUXadhkn.exe
File opened for modification	C:\Windows\IME	QUXadhkn.exe
File opened for modification	C:\Windows\Help	QUXadhkn.exe
File opened for modification	C:\Windows\Temp	QUXadhkn.exe
File opened for modification	C:\Windows\Panther\unattend.xml	QUXadhkn.exe
File opened for modification	C:\Windows\apppatch	QUXadhkn.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1556	cmd.exe
5432	cmd.exe
6060	cmd.exe
4896	cmd.exe
4616	cmd.exe
2748	cmd.exe
5488	cmd.exe
4148	cmd.exe
5424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5116	PING.EXE
5424	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4572	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\First Home Page = "http://c.ub9.cn"	QUXadhkn.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MINIE	QUXadhkn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://c.ub9.cn"	QUXadhkn.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\TypedURLs	QUXadhkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN	QUXadhkn.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	QUXadhkn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://c.ub9.cn"	QUXadhkn.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	QUXadhkn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\First Home Page = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://c.ub9.cn"	QUXadhkn.exe

Modifies Internet Explorer start page 1 TTPs 3 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://c.ub9.cn"	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://c.ub9.cn"	QUXadhkn.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	QUXadhkn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	QUXadhkn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	QUXadhkn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	QUXadhkn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Internet Explorer	QUXadhkn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main\Start Page = "http://c.ub9.cn"	QUXadhkn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main	QUXadhkn.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\ = "Text Document"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\open\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\open	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\{E82A1BA7-3493-47e1-A673-9277E8695AFA}\ = "百度一下(&B)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\Content Type = "text/plain"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ShellNew\NullFile	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	QUXadhkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	QUXadhkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	QUXadhkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\DefaultIcon\ = "%SystemRoot%\\system32\\imageres.dll,-102"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\print\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\FriendlyTypeName = "@%SystemRoot%\\system32\\notepad.exe,-469"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\print	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\printto	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "txtfilelegacy"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\EditFlags = "2162688"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\print\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE /p %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\{E82A1BA7-3493-47e1-A673-9277E8695AFA}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\{E82A1BA7-3493-47e1-A673-9277E8695AFA}\icon = "C:\\Windows\\System32\\bdpic.ico"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\{E82A1BA7-3493-47e1-A673-9277E8695AFA}\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\{E82A1BA7-3493-47e1-A673-9277E8695AFA}\command\ = "explorer.exe http://bd.dh021.com"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	QUXadhkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ShellNew	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\printto\command\ = "%SystemRoot%\\system32\\notepad.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	QUXadhkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfilelegacy\shell\printto\command	regedit.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\CIMV2	QUXadhkn.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4788	regedit.exe
2664	regedit.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5116	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe
3344	QUXadhkn.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3344	QUXadhkn.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeShutdownPrivilege	3344	QUXadhkn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	LogonUI.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3344	3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe	89
PID 3344 wrote to memory of 1556	3344	QUXadhkn.exe	90
PID 1556 wrote to memory of 4572	1556	cmd.exe	93
PID 3344 wrote to memory of 5488	3344	QUXadhkn.exe	96
PID 5488 wrote to memory of 2664	5488	cmd.exe	98
PID 3344 wrote to memory of 5432	3344	QUXadhkn.exe	100
PID 3344 wrote to memory of 3656	3344	QUXadhkn.exe	101
PID 3344 wrote to memory of 6088	3344	QUXadhkn.exe	102
PID 3344 wrote to memory of 1716	3344	QUXadhkn.exe	103
PID 3344 wrote to memory of 4148	3344	QUXadhkn.exe	104
PID 3344 wrote to memory of 6060	3344	QUXadhkn.exe	105
PID 3344 wrote to memory of 1744	3344	QUXadhkn.exe	107
PID 3344 wrote to memory of 4800	3344	QUXadhkn.exe	108
PID 4800 wrote to memory of 3884	4800	cmd.exe	116
PID 1744 wrote to memory of 1824	1744	cmd.exe	117
PID 3344 wrote to memory of 4896	3344	QUXadhkn.exe	118
PID 4896 wrote to memory of 4788	4896	cmd.exe	120
PID 3344 wrote to memory of 4616	3344	QUXadhkn.exe	121
PID 3416 wrote to memory of 5424	3416	2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe	123
PID 5424 wrote to memory of 5116	5424	cmd.exe	125
PID 3344 wrote to memory of 2748	3344	QUXadhkn.exe	127
PID 3344 wrote to memory of 6044	3344	QUXadhkn.exe	128
PID 6044 wrote to memory of 5272	6044	cmd.exe	132
PID 2748 wrote to memory of 3528	2748	cmd.exe	131
PID 3528 wrote to memory of 5260	3528	net.exe	133

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	QUXadhkn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	QUXadhkn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	QUXadhkn.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\QUXadhkn.exe
  C:\Users\Admin\AppData\Local\Temp\QUXadhkn.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies security service
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c regedit /s C:\Users\Admin\AppData\Local\Temp\baidu.reg
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\baidu.reg
      4⤵
      Modifies registry class
      Runs .reg file with regedit
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "%programfiles%\SysCeo";"%programfiles(x86)%\SysCeo"
    3⤵
    - Executes a command shell one-liner
    PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /q /f "%systemroot%\Help\dcold.exe"
    3⤵
    PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /q /f "%userprofile%\Desktop\Çý¶¯×Ü²Ã.lnk";"%homedrive%\Users\Public\Desktop\Çý¶¯×Ü²Ã.lnk"
    3⤵
    PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /q /f "%homedrive%\ProgramData\Microsoft\Windows\Start Menu\Çý¶¯ÏÂÔØ.lnk"
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "%homedrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Çý¶¯×Ü²Ã"
    3⤵
    - Executes a command shell one-liner
    PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "%homedrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Çý¶¯×Ü²Ã2.0"
    3⤵
    - Executes a command shell one-liner
    PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /delete /tn GoogleSystem /f
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn GoogleSystem /f
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /delete /tn Mozilla /f
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn Mozilla /f
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c regedit /s C:\Users\Admin\AppData\Local\Temp\win11txt.reg
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\win11txt.reg
      4⤵
      Modifies registry class
      Runs .reg file with regedit
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c date 2026/08/06 & time 18:46:38
    3⤵
    - Executes a command shell one-liner
    PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop CscService
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\system32\net.exe
      net stop CscService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop CscService
        5⤵
        
        PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /delete /tn GoogleSystem /f
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn GoogleSystem /f
      4⤵
      PID:5272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 4&del /q C:\Users\Admin\AppData\Local\Temp\2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stea.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5116

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies registry class
PID:608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a3c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QUXadhkn.exe

Path C:\Users\Admin\AppData\Local\Temp\QUXadhkn.exe
Size 1.1MB
SHA256 b0bc6939e7a6414c1eb4f64cc2b27f04584866f74ffd3497e1703db3a29aa3da
MD5 f7279d80ca0b3c5efb2614db2a06d6c9
SHA1 f6b99c710352e4b07f5fedcadb97360dd04793ab
SHA512 1ba7a91cf46a0baafa59e279b71d4c10414afdf238701b2e28adb878e896051e5cdb52487c23e1bdbd2c6cac15c8c56dcc61d7ab0952395ad1df8549aa07c708
SSDEEP 24576:n0/wH2fMinErsWguWHbL7pYcVX6u5MSZgEwYpkhj9thjtfHQpxhw5:0W2frO1fW7L7pPVqu5MSZqd9tHfHQpxC
TLSH
T151353367F41D6A69E0152C74E537F2F0C254B036B87694DA4A7BC6A9ED37BC9C080A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baidu.reg

Path C:\Users\Admin\AppData\Local\Temp\baidu.reg
Size 752B
SHA256 f18ada26b94f662da2e3a9b800a851d86e9450d25cdcc2e8ea84565c803b59fa
MD5 f4a0f95f1785a0f1b2f83d04abd37e4a
SHA1 794ef0460cc1f55cbde0bb74c74b991eee153cbb
SHA512 e1f5e3f4b3fd1af418624047b530a4eedfa42011b3788fa7d7d305f3b1484caabcfedfbcb66972eec16e1e4786b6eb2ac0f8382562a70aa12dd3d4dc16250aa7
TLSH
T1D301D46623E11149F7F2B5C45FA8DC608B36BA42682B8DAD00C0054A08F1E199C52FBB
MD5 SHA1 SHA512 TLSH

Submit Download

win11txt.reg

Path C:\Users\Admin\AppData\Local\Temp\win11txt.reg
Size 4KB
SHA256 bd1ee3fc56fbbe861b4f3a23fa01486ea087cca19968f8db9088287ebcb7398d
MD5 2d96690f7f9e7e65dcfd4ecba7b9641a
SHA1 8ed78d214a108abf97b906238321bc5dc94dbd0c
SHA512 4cf28233c93ad56fc0b636ac8cd350fadcb815c495198fdac037b82541c99735f18948cb1132ccd774333dc6dd8a39ed348322ef58b34299ebad3b5c563116d3
SSDEEP 96:mEGzLYvYSHckrJ6WGoYSnctDJPddvYSnctpQCzIgYSnctpQCyL5YSnctfWJ6Wp:mfzLOZH3ooZnStddvZnSpQCzIgZnSpQF
TLSH
T1D681A07EDBA234465373AD64EFE78423E7596953242EEC8D00C3274905D2A58B4A23BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3344-27-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-28-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-9-0x000001E549250000-0x000001E549252000-memory.dmp

Download

memory/3344-7-0x000001E549240000-0x000001E549241000-memory.dmp

Download

memory/3344-8-0x000001E549230000-0x000001E549231000-memory.dmp

Download

memory/3344-4-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-29-0x000001E549250000-0x000001E549252000-memory.dmp

Download

memory/3344-6-0x000001E549110000-0x000001E549111000-memory.dmp

Download

memory/3344-40-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-42-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-43-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-46-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-51-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-53-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

memory/3344-60-0x00007FF69B690000-0x00007FF69B8A9000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads