a9757bbb1913b9681989b9d6d00d8ecddf53d10de7e4cbfe313fcdc5bb300e53

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
insoft_v10.0.18.exe
Size 35.0MB
Sample260815-3fca2swvbz
SHA256 a9757bbb1913b9681989b9d6d00d8ecddf53d10de7e4cbfe313fcdc5bb300e53
MD5 952150da4e9cf416988f94d40a07ea54
SHA1 9bcf5fa502ab3f6317442be92fd4b2f2ab6e045d
SHA512 1867f24f92ea7faa131670d735480d9e4fe42ae3e2b4aadcd87eeecb4767ee7918235fe5835871417d0f5788a92448458ccea4c9af59d60fcc9a7547cb350ad8
SSDEEP 196608:eQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgAA:zKJnGBr4Xu7vU2
TLSH
T1DD87074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	s9bm4u.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\2eaFfZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	acwmKq.exe

Executes dropped EXE 3 IoCs

pid	Process
5316	acwmKq.exe
4780	acwmKq.exe
5216	s9bm4u.exe

Loads dropped DLL 3 IoCs

pid	Process
5316	acwmKq.exe
4780	acwmKq.exe
5216	s9bm4u.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1556	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\2eaFfZ\\acwmKq.exe\""	acwmKq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\s9bm4u\\s9bm4u.exe\""	s9bm4u.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2064	cmd.exe
4380	cmd.exe
5812	cmd.exe
404	cmd.exe
3916	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	acwmKq.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\s9bm4u\image.png	acwmKq.exe
File created	C:\Program Files (x86)\s9bm4u\thumbs.db	acwmKq.exe
File opened for modification	C:\Program Files (x86)\s9bm4u\XPSPLOG.dll	acwmKq.exe
File opened for modification	C:\Program Files (x86)\s9bm4u	acwmKq.exe
File created	C:\Program Files (x86)\s9bm4u\XPSPLOG.dll	acwmKq.exe
File opened for modification	C:\Program Files (x86)\s9bm4u\s9bm4u.exe	acwmKq.exe
File opened for modification	C:\Program Files (x86)\s9bm4u\image.png	acwmKq.exe
File opened for modification	C:\Program Files (x86)\s9bm4u\thumbs.db	acwmKq.exe
File created	C:\Program Files (x86)\s9bm4u\s9bm4u.exe	acwmKq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5744	cmd.exe
2236	cmd.exe
1816	cmd.exe
1080	cmd.exe
312	cmd.exe
396	cmd.exe
1696	cmd.exe
5556	cmd.exe
4356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s9bm4u.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	acwmKq.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4388	schtasks.exe
444	schtasks.exe
4036	schtasks.exe
4996	schtasks.exe
472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5456	insoft_v10.0.18.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe
5316	acwmKq.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 4380	5316	acwmKq.exe	103
PID 4380 wrote to memory of 4036	4380	cmd.exe	106
PID 4380 wrote to memory of 4972	4380	cmd.exe	107
PID 5316 wrote to memory of 5812	5316	acwmKq.exe	111
PID 4380 wrote to memory of 2620	4380	cmd.exe	113
PID 5812 wrote to memory of 4996	5812	cmd.exe	114
PID 5812 wrote to memory of 4732	5812	cmd.exe	116
PID 4356 wrote to memory of 5536	4356	cmd.exe	117
PID 5316 wrote to memory of 404	5316	acwmKq.exe	118
PID 5812 wrote to memory of 5496	5812	cmd.exe	119
PID 404 wrote to memory of 472	404	cmd.exe	121
PID 404 wrote to memory of 2368	404	cmd.exe	122
PID 1080 wrote to memory of 180	1080	cmd.exe	125
PID 404 wrote to memory of 1424	404	cmd.exe	126
PID 5316 wrote to memory of 3916	5316	acwmKq.exe	127
PID 3916 wrote to memory of 4388	3916	cmd.exe	129
PID 3916 wrote to memory of 3008	3916	cmd.exe	130
PID 5316 wrote to memory of 2064	5316	acwmKq.exe	132
PID 3916 wrote to memory of 5396	3916	cmd.exe	134
PID 2064 wrote to memory of 444	2064	cmd.exe	135
PID 2064 wrote to memory of 5644	2064	cmd.exe	136
PID 2064 wrote to memory of 5308	2064	cmd.exe	138
PID 396 wrote to memory of 4988	396	cmd.exe	141
PID 312 wrote to memory of 1932	312	cmd.exe	142
PID 5316 wrote to memory of 5216	5316	acwmKq.exe	143

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	s9bm4u.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\insoft_v10.0.18.exe
"C:\Users\Admin\AppData\Local\Temp\insoft_v10.0.18.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5456

C:\Users\Public\2eaFfZ\acwmKq.exe
C:\Users\Public\2eaFfZ\acwmKq.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2eaFfZ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2eaFfZ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5644
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5308
- C:\Program Files (x86)\s9bm4u\s9bm4u.exe
  "C:\Program Files (x86)\s9bm4u\s9bm4u.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:5216
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:5744
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\s9bm4u" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1696
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\s9bm4u" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1816

C:\Users\Public\2eaFfZ\acwmKq.exe
"C:\Users\Public\2eaFfZ\acwmKq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4780

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2eaFfZ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2eaFfZ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5536

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4848

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:180

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1932

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4988

C:\Program Files (x86)\s9bm4u\s9bm4u.exe
"C:\Program Files (x86)\s9bm4u\s9bm4u.exe"
1⤵
PID:632

C:\Program Files (x86)\Q0Iqqm9A\FQebu4.exe
"C:\Program Files (x86)\Q0Iqqm9A\FQebu4.exe"
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Q0Iqqm9A\XPSPLOG.dll
Size 4.6MB
SHA256 a4d341fed8f81c020efa879e16ba3c427c336e2b75d3cdd781401c1c91d1cc32
MD5 1d6921c0dec39a6165bab520185c0888
SHA1 c4bc2a8bb6ac8df23b3bad07742599d34e8f3fda
SHA512 1c04e17f6b34f0a7bd7e66b15bd0b8e14c339a70f422006169b0958658ad8a8aa3ee62c876495e201b29356fdecb012938666a752579f80590aab971499cc971
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyA:BMWKfU+BcUTHCCCfqCiUffnA
TLSH
T168263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\s9bm4u\XPSPLOG.dll
Size 4.6MB
SHA256 4587b19fc2d0795801a3ecdc13acf2121de259441f966c1af1a1f36346194154
MD5 ae047bcb2c8b99681e2af0a5d86e02e0
SHA1 7d5a3e7b94008082efdbc41120de218148f1834a
SHA512 49c616e36143d100e7c587630b92a8a4769df3f35b9b777b894f8fc7999354d146ab6d9196c6bd13277a7bace113f3edafaee327e9fcf17e5711a3e514caed1b
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy+:BMWKfU+BcUTHCCCfqCiUffn+
TLSH
T1A6263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\s9bm4u\image.png
Size 5.0MB
SHA256 dbd438eb2cf3ca3487e7fad30468a24c431df0d617be297122dad975aad2c8fe
MD5 2b595d2ba8fb298cf4b8cb813bccb595
SHA1 0788274ffdf5bde6acc10f35815fc3fc46e0a360
SHA512 fa77e8667d362c5badc6f95d7f9cab3b9058b0cf155491bae1738fb086abb0cbe191135918a8152a22b29b2433e6c6b3cf7903af64e642b7d6703414c419f58b
SSDEEP 98304:LFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:IRIUjDgAk+jkn/IXhVaK
TLSH
T14A3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s9bm4u.exe

Path C:\Program Files (x86)\s9bm4u\s9bm4u.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\s9bm4u\thumbs.db
Size 358KB
SHA256 170fc9f592679462ecb0782199e9bf770dc7d4a8f8429d422e9135f1080a7abc
MD5 a8701563790f1b690174f29050cfeb72
SHA1 c628a4e1846dc1af0e7a1e235edc2e5134b46e64
SHA512 52b2df84194a61771ef616970b8c5f547989b492db14f2c0a02bf01beb614ea814bf112842e2a0f64594e07a7401dad58cdcc73c400debc817a17031370b197c
SSDEEP 6144:9iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:08u69CghoQxoMTFQqtKFCz7mb/
TLSH
T16774F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\2eaFfZ\UxEnhance64.dll
Size 3.1MB
SHA256 f24120dbfe60c62e14664f65c0c3a8e2a258907315af1589561e45749b60b195
MD5 de6eea5ec113e9b8516cd30179782af5
SHA1 22b6acdfb7abdb3cbab86510c412b8f8bb8b27ee
SHA512 d6c31ebe1f7499f6c4a22cd48244ceb36335440de8b2d155d20f5aa6040b49c467900c9c00de0d0904d4b1fb1ad1a2fc647f821c4172a1bcdb45fe9915c63f80
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+7:P9m29xx3Tiqt06ox6+z2rNNrKo7
TLSH
T164E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acwmKq.exe

Path C:\Users\Public\2eaFfZ\acwmKq.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\2eaFfZ\adoresd.dat
Size 4.7MB
SHA256 d3f581b918d5db6d249510e2d27598914338ea01410138d2f982c534178f21ab
MD5 4c4201b6bd8f20b76cbb28cb0e25b303
SHA1 04d7a74e629ff7f855e8dcc524edc7268e60bd12
SHA512 525b7eebf61fa6e7213b65ee52fd097df513a4aa7d4beb8502829a0f3bc816ee603bb164d4a67ac84a8a5fdf0809e47692ee8ca991d4148eea0f6955383d7e0d
SSDEEP 98304:PKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:PKClqhi0Cv54K2IVS0VQg
TLSH
T14D3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\2eaFfZ\msadox.tb
Size 8KB
SHA256 b15e4d4e370a7af1f4d8b8f1ef69ed3d63d9c895289c82728cb2cbe5d7846868
MD5 6799665fb39f8a8dbafc058e33518d78
SHA1 471fe1a8e19fd972e52420f87c068b168b77e1c9
SHA512 5f03126e5e1467be149b68fb1632d70f8628ea8bd747a099ed65ec73333bc2a6bc27637e671019dadb20df4adb2e4ecb8b385b2f128d5702fa60680272ffe5de
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T198029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/632-722-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/632-723-0x0000000074A60000-0x00000000751AA000-memory.dmp

Download

memory/4780-592-0x0000029F03160000-0x0000029F039E7000-memory.dmp

Download

memory/4780-584-0x00007FFF90000000-0x00007FFF90002000-memory.dmp

Download

memory/4780-590-0x0000029F03160000-0x0000029F039E7000-memory.dmp

Download

memory/4780-585-0x0000029F03160000-0x0000029F039E7000-memory.dmp

Download

memory/4780-593-0x00007FFF8FFF0000-0x00007FFF8FFF2000-memory.dmp

Download

memory/4780-589-0x0000029F03160000-0x0000029F039E7000-memory.dmp

Download

memory/4780-576-0x0000029F03160000-0x0000029F039E7000-memory.dmp

Download

memory/4780-573-0x00007FFF71DE0000-0x00007FFF722FE000-memory.dmp

Download

memory/4780-591-0x0000029F03160000-0x0000029F039E7000-memory.dmp

Download

memory/5216-673-0x00000000016E0000-0x00000000016E1000-memory.dmp

Download

memory/5216-685-0x0000000004420000-0x0000000004434000-memory.dmp

Download

memory/5216-705-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/5216-701-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/5216-666-0x00000000016C0000-0x00000000016C1000-memory.dmp

Download

memory/5216-688-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/5216-667-0x0000000074A60000-0x00000000751AA000-memory.dmp

Download

memory/5216-671-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/5216-702-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5216-678-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/5216-675-0x0000000003A50000-0x0000000004253000-memory.dmp

Download

memory/5316-543-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-545-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-564-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-558-0x000001F14FC90000-0x000001F14FD1A000-memory.dmp

Download

memory/5316-555-0x000001F14F7B0000-0x000001F14F7FE000-memory.dmp

Download

memory/5316-556-0x000001F14FC90000-0x000001F14FD1A000-memory.dmp

Download

memory/5316-559-0x000001F14FC90000-0x000001F14FD1A000-memory.dmp

Download

memory/5316-557-0x000001F14FC90000-0x000001F14FD1A000-memory.dmp

Download

memory/5316-550-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-546-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-538-0x00007FFF90000000-0x00007FFF90002000-memory.dmp

Download

memory/5316-565-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-544-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-539-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-530-0x00007FFF8FFF0000-0x00007FFF8FFF2000-memory.dmp

Download

memory/5316-536-0x000001F14EEE0000-0x000001F14F767000-memory.dmp

Download

memory/5316-531-0x00007FFF71DE0000-0x00007FFF722FE000-memory.dmp

Download

memory/5456-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/5456-524-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/5456-525-0x00007FFF8AA20000-0x00007FFF8AA30000-memory.dmp

Download

memory/5456-504-0x00007FFF8AA20000-0x00007FFF8AA30000-memory.dmp

Download

memory/5456-2-0x0000000000510000-0x000000000051C000-memory.dmp

Download

memory/5456-1-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download