keybase | 5bae4d401255d4fb81575c79ede82f737c340d2d4d4d2e6b9c35b9c00c72d4a0

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
Size 3.5MB
Sample260813-br4e5ahl5s
SHA256 5bae4d401255d4fb81575c79ede82f737c340d2d4d4d2e6b9c35b9c00c72d4a0
MD5 3cf2e73832e589c7d8920584dc0a16a8
SHA1 f77a2e86db885b798003c31ef69cf117dd94884f
SHA512 61b1cb8a26f104e61b6652133eca116c72751eb62b450c2bc58bab8b35fa66e158ba5764a38f5fa7b89f2015c09fded940ccb9d4568256b436e5ac6dcad09c01
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtD:jbCjPKNqQIFIbBMy+bCjPKNqQI0
TLSH
T16606C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution keybase persistence stealer

Malware Config

Signatures

Family: KeyBase
KeyBase is a .NET credential stealer and keylogger first emerging in February 2015.
stealer keybase

Detects KeyBase stealer 1 IoCs

resource	yara_rule
behavioral2/memory/4712-12-0x0000000000980000-0x0000000000A2A000-memory.dmp	family_keybase

Executes dropped EXE 4 IoCs

pid	Process
5820	winmgr21.exe
5832	winmgr21.exe
1420	winmgr21.exe
3352	winmgr21.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	winmgr21.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000f00000001c582-6.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5820 set thread context of 4712	5820	winmgr21.exe	89
PID 4712 set thread context of 2792	4712	RegAsm.exe	92

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe:Zone.Identifier:$DATA	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe:Zone.Identifier:$DATA	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1736	schtasks.exe
2980	schtasks.exe
1260	schtasks.exe
4092	schtasks.exe
1120	schtasks.exe
3408	schtasks.exe
6064	schtasks.exe
3700	schtasks.exe
1936	schtasks.exe
2536	schtasks.exe
2200	schtasks.exe
1476	schtasks.exe
3004	schtasks.exe
3332	schtasks.exe
3728	schtasks.exe
5728	schtasks.exe
5740	schtasks.exe
2868	schtasks.exe
4984	schtasks.exe
404	schtasks.exe
3320	schtasks.exe
4144	schtasks.exe
5132	schtasks.exe
4356	schtasks.exe
5416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4876	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
4876	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5832	winmgr21.exe
5832	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
1420	winmgr21.exe
1420	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
3352	winmgr21.exe
3352	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe
5820	winmgr21.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
4876	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
5820	winmgr21.exe
5832	winmgr21.exe
1420	winmgr21.exe
3352	winmgr21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	RegAsm.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5820	4876	2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe	88
PID 5820 wrote to memory of 4712	5820	winmgr21.exe	89
PID 5820 wrote to memory of 4712	5820	winmgr21.exe	89
PID 5820 wrote to memory of 4712	5820	winmgr21.exe	89
PID 5820 wrote to memory of 5132	5820	winmgr21.exe	90
PID 4712 wrote to memory of 2792	4712	RegAsm.exe	92
PID 4712 wrote to memory of 2792	4712	RegAsm.exe	92
PID 4712 wrote to memory of 2792	4712	RegAsm.exe	92
PID 4712 wrote to memory of 2792	4712	RegAsm.exe	92
PID 4712 wrote to memory of 2792	4712	RegAsm.exe	92
PID 4712 wrote to memory of 2792	4712	RegAsm.exe	92
PID 5820 wrote to memory of 3728	5820	winmgr21.exe	96
PID 5820 wrote to memory of 4356	5820	winmgr21.exe	98
PID 5820 wrote to memory of 5728	5820	winmgr21.exe	100
PID 5820 wrote to memory of 5416	5820	winmgr21.exe	102
PID 5820 wrote to memory of 2536	5820	winmgr21.exe	104
PID 5820 wrote to memory of 4092	5820	winmgr21.exe	106
PID 5820 wrote to memory of 1120	5820	winmgr21.exe	108
PID 5820 wrote to memory of 1736	5820	winmgr21.exe	110
PID 5820 wrote to memory of 5740	5820	winmgr21.exe	112
PID 5820 wrote to memory of 2868	5820	winmgr21.exe	114
PID 5820 wrote to memory of 3408	5820	winmgr21.exe	117
PID 5820 wrote to memory of 6064	5820	winmgr21.exe	119
PID 5820 wrote to memory of 2200	5820	winmgr21.exe	121
PID 5820 wrote to memory of 1476	5820	winmgr21.exe	123
PID 5820 wrote to memory of 2980	5820	winmgr21.exe	125
PID 5820 wrote to memory of 1260	5820	winmgr21.exe	127
PID 5820 wrote to memory of 3700	5820	winmgr21.exe	129
PID 5820 wrote to memory of 4984	5820	winmgr21.exe	131
PID 5820 wrote to memory of 3004	5820	winmgr21.exe	133
PID 5820 wrote to memory of 404	5820	winmgr21.exe	135
PID 5820 wrote to memory of 1936	5820	winmgr21.exe	137
PID 5820 wrote to memory of 3320	5820	winmgr21.exe	139
PID 5820 wrote to memory of 3332	5820	winmgr21.exe	142
PID 5820 wrote to memory of 4144	5820	winmgr21.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_3cf2e73832e589c7d8920584dc0a16a8_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4876
- C:\ProgramData\winmgr21.exe
  C:\ProgramData\winmgr21.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /stext C:\ProgramData\Mails.txt
      4⤵
      PID:2792
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3728
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5416
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4092
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1736
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2200
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:404
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4144

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5832

C:\ProgramData\winmgr21.exe
"C:\ProgramData\winmgr21.exe"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1420

C:\ProgramData\winmgr21.exe
"C:\ProgramData\winmgr21.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winmgr21.exe

Path C:\ProgramData\winmgr21.exe
Size 3.5MB
SHA256 71aab63d59ed6050e068a7032e83c7200408535888b919f7c3a50d9af4590726
MD5 9f45e2f50a0adf227e1f00b4005d7a92
SHA1 cb2b8e1bbaf021771fa92b7c2e44d25acd6c5817
SHA512 7a211d5f9085b72bed585f632355b1fcb806e81d79f569c9fb118ed49b82d960063d84ad016ac3de32a4963b80ab335a28ad5dd58837471b79d92186c1c85eea
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHt0:jbCjPKNqQIFIbBMy+bCjPKNqQIR
TLSH
T18906C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4712-12-0x0000000000980000-0x0000000000A2A000-memory.dmp

Download

memory/4712-14-0x00000000730F2000-0x00000000730F4000-memory.dmp

Download

memory/4712-13-0x0000000002940000-0x0000000002950000-memory.dmp

Download

memory/4712-18-0x0000000002940000-0x0000000002950000-memory.dmp

Download

memory/4712-19-0x00000000730F2000-0x00000000730F4000-memory.dmp

Download