knight_logger | 335607b5d76a6a98896ab30cdd36b1d83041c9a52449771983b9fe00fd50950e

Analysis

max time kernel
104s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
Size 2.6MB
Sample260818-v94cmaeq41
SHA256 335607b5d76a6a98896ab30cdd36b1d83041c9a52449771983b9fe00fd50950e
MD5 6dda1ed8cb52ccbecbbe1fbdb8d372d6
SHA1 11eaa8b1ebf477ae3a710d8a963b9c9b743ded4e
SHA512 6b4d510e827354eaa8f3540bf73282b7cddcaf38953195182ae2ff5aa07756e448f49c3efc0727d3e83b42eaf97c8bac544f0066768ab6df2178c03f95b63015
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4ex:ObCjPKNqQEfsw43qtmVfq48
TLSH
T1EDC5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution knight_logger persistence spyware stealer upx

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.mail.me.com
Port
587
Username
[email protected]
Password
RICHARD205lord

Signatures

Family: KnightLogger
KnightLogger is a Windows stealer written in C#.
stealer knight_logger

Detects executables packed with MEW 1 IoCs

resource	yara_rule
behavioral2/memory/5864-27-0x0000000000400000-0x000000000043C000-memory.dmp	INDICATOR_EXE_Packed_MEW

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1808-20-0x0000000000400000-0x000000000048E000-memory.dmp	UPX
behavioral2/memory/4948-24-0x0000000000400000-0x0000000000491000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4856	winmgr119.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	jhdfkldfhndfkjdfnbfklfnf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
1	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001600000001c43a-4.dat	autoit_exe
behavioral2/files/0x0006000000016d97-8.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4524 set thread context of 1160	4524	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 1160 set thread context of 1808	1160	RegAsm.exe	96
PID 1160 set thread context of 4948	1160	RegAsm.exe	97
PID 1160 set thread context of 5864	1160	RegAsm.exe	98

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1808-20-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4948-24-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe:Zone.Identifier:$DATA	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhdfkldfhndfkjdfnbfklfnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe:Zone.Identifier:$DATA	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5956	schtasks.exe
5412	schtasks.exe
4584	schtasks.exe
2372	schtasks.exe
5092	schtasks.exe
1828	schtasks.exe
3352	schtasks.exe
5300	schtasks.exe
3404	schtasks.exe
4860	schtasks.exe
1608	schtasks.exe
1612	schtasks.exe
2384	schtasks.exe
3540	schtasks.exe
1496	schtasks.exe
2556	schtasks.exe
1112	schtasks.exe
3548	schtasks.exe
4328	schtasks.exe
5712	schtasks.exe
2996	schtasks.exe
1964	schtasks.exe
1384	schtasks.exe
5640	schtasks.exe
2760	schtasks.exe
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4748	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
4748	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4856	winmgr119.exe
4856	winmgr119.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
1160	RegAsm.exe
1160	RegAsm.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe
4524	jhdfkldfhndfkjdfnbfklfnf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1160	RegAsm.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4524	4748	2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe	90
PID 4524 wrote to memory of 1160	4524	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 4524 wrote to memory of 1160	4524	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 4524 wrote to memory of 1160	4524	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 4524 wrote to memory of 2556	4524	jhdfkldfhndfkjdfnbfklfnf.exe	92
PID 1160 wrote to memory of 1808	1160	RegAsm.exe	96
PID 1160 wrote to memory of 1808	1160	RegAsm.exe	96
PID 1160 wrote to memory of 1808	1160	RegAsm.exe	96
PID 1160 wrote to memory of 1808	1160	RegAsm.exe	96
PID 1160 wrote to memory of 4948	1160	RegAsm.exe	97
PID 1160 wrote to memory of 4948	1160	RegAsm.exe	97
PID 1160 wrote to memory of 4948	1160	RegAsm.exe	97
PID 1160 wrote to memory of 4948	1160	RegAsm.exe	97
PID 1160 wrote to memory of 5864	1160	RegAsm.exe	98
PID 1160 wrote to memory of 5864	1160	RegAsm.exe	98
PID 1160 wrote to memory of 5864	1160	RegAsm.exe	98
PID 4524 wrote to memory of 4584	4524	jhdfkldfhndfkjdfnbfklfnf.exe	99
PID 4524 wrote to memory of 1112	4524	jhdfkldfhndfkjdfnbfklfnf.exe	102
PID 4524 wrote to memory of 1384	4524	jhdfkldfhndfkjdfnbfklfnf.exe	104
PID 4524 wrote to memory of 5640	4524	jhdfkldfhndfkjdfnbfklfnf.exe	106
PID 4524 wrote to memory of 3548	4524	jhdfkldfhndfkjdfnbfklfnf.exe	108
PID 4524 wrote to memory of 5300	4524	jhdfkldfhndfkjdfnbfklfnf.exe	110
PID 4524 wrote to memory of 2760	4524	jhdfkldfhndfkjdfnbfklfnf.exe	112
PID 4524 wrote to memory of 4232	4524	jhdfkldfhndfkjdfnbfklfnf.exe	114
PID 4524 wrote to memory of 4328	4524	jhdfkldfhndfkjdfnbfklfnf.exe	116
PID 4524 wrote to memory of 5712	4524	jhdfkldfhndfkjdfnbfklfnf.exe	118
PID 4524 wrote to memory of 2372	4524	jhdfkldfhndfkjdfnbfklfnf.exe	120
PID 4524 wrote to memory of 3404	4524	jhdfkldfhndfkjdfnbfklfnf.exe	122
PID 4524 wrote to memory of 4860	4524	jhdfkldfhndfkjdfnbfklfnf.exe	124
PID 4524 wrote to memory of 1608	4524	jhdfkldfhndfkjdfnbfklfnf.exe	126
PID 4524 wrote to memory of 1612	4524	jhdfkldfhndfkjdfnbfklfnf.exe	128
PID 4524 wrote to memory of 5956	4524	jhdfkldfhndfkjdfnbfklfnf.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_6dda1ed8cb52ccbecbbe1fbdb8d372d6_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
- C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp6A39.tmp"
      4⤵
      PID:1808
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp6A89.tmp"
      4⤵
      PID:4948
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp6AB8.tmp"
      4⤵
      PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2556
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5300
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2760
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4232
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5712
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5956
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1828
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3540
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1964

C:\ProgramData\winmgr119.exe
C:\ProgramData\winmgr119.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jhdfkldfhndfkjdfnbfklfnf.exe

Path C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
Size 2.6MB
SHA256 c9467cdf8dd0fa43b782d5accdad28f9c74e6f9c8c457ec4fc3b625fcb672fd2
MD5 f3f7f27221b8d26d939120330a6c3df0
SHA1 280c21c45547eed33ae3316657f38665e1e4aeee
SHA512 1d82d984c3b27a683c3d78c7a593a0c0fcb2904f9e7bfdf525b809bc918b60fc870ee0d52bd664808459fd34f492f3822dc8c202a607756e865a919803744e4a
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4eS:ObCjPKNqQEfsw43qtmVfq4F
TLSH
T186C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ec746e680934bcbbb1e77361f007ffd

Path C:\ProgramData\khaxFMfI\6ec746e680934bcbbb1e77361f007ffd
Size 8B
SHA256 352fbf742bc48bddf35c74576c7784caa73415a0932faaadb83f9042d0e2dacb
MD5 260baaa9c40ef2b3126041d50c59c43c
SHA1 98aaf3f16519465f2f32f959b4042067d6abc248
SHA512 3eb2f0757b0584e4a29291eda5fd09144bc308c86c3861345df395711e4bd3fea49791836fd216c8f914af903cdf71fc22fa580432962bfc54684b9aa268a693
MD5 SHA1 SHA512

Submit Download

winmgr119.exe

Path C:\ProgramData\winmgr119.exe
Size 2.6MB
SHA256 30408607a389b2a611ee912f01da5d93ea09e263a8780a727f4c889ef5c82c68
MD5 de9dec3f843cbd4ccc1186beb9d71344
SHA1 a9d9f1d63250d4d96be9d0279141d7cfdd45228a
SHA512 1c94329bb7ce3374dfb54793e80f95dfa5707ef9010c12aab142879ecf9ca9a85c6e095acd728905c74f88f858fc3049fd6ddc7b302ebfb0cb56461e21310f60
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e5:ObCjPKNqQEfsw43qtmVfq4w
TLSH
T152C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-9-0x0000000000C30000-0x0000000000CFA000-memory.dmp

Download

memory/1160-10-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/1160-11-0x0000000073342000-0x0000000073344000-memory.dmp

Download

memory/1160-31-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/1160-32-0x0000000073342000-0x0000000073344000-memory.dmp

Download

memory/1808-20-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/4948-24-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/5864-27-0x0000000000400000-0x000000000043C000-memory.dmp

Download