Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
- Size 12.1MB
- Sample260822-bdj5bszelf
- SHA256 2b53e90c93d4a6ddc064dd4711d22fef5530eff859447ef988db92949d05fd39
- MD5 db5e56897498c56ced1f2cb84676d4bc
- SHA1 50fb6f989b4ad3372fbff23fc91da26648b47982
- SHA512 510275a206a5d49b0c6c458aad5aca1d2391ac52d944a4ab8a20e3402f5532104ba6ef506904325f2bca83614e0a201b94f42b94833bc4514c82444699f9ce56
- SSDEEP 393216:Q8rLyy10H2BgDy98POpILqlkXmxwTitsYpkt3vaGYBloK5:Qw10H2BgDy98POpILqlkXmxwTitsjU
- TLSH T18CD69C00B7E08526E47E53B884B3821D87B4FC66AB66E3CF579025AD2E72381DD3175B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 5720 netsh.exe 2980 netsh.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LTService\ImagePath = "\"C:\\Windows\\LTSvc\\LTSVC.exe\" -sLTService" installutil.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 9 IoCs
pid Process 1928 LTSVC.exe 4788 tvnserver.exe 2444 tvnserver.exe 5512 tvnserver.exe 5152 tvnserver.exe 556 tvnserver.exe 4872 tvnserver.exe 1612 LTTray.exe 1964 LTSVC.exe - Loads dropped DLL 2 IoCs
pid Process 1928 LTSVC.exe 6040 regsvr32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tvncontrol = "\"C:\\Windows\\LTsvc\\tvnserver.exe\" -controlservice -slave" tvnserver.exe - Modifies boot configuration data using bcdedit 1 IoCs
pid Process 5516 BCDedit.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3 LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3 LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 LTSVC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F LTSVC.exe - Drops file in Windows directory 29 IoCs
description ioc Process File created C:\Windows\LTSvc\wodVPN64.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTsvc\labvnc.ini LTSVC.exe File created C:\Windows\LTSvc\LTSVC.exe 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\PS.exe 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\LTSVC.InstallState installutil.exe File created C:\Windows\LTsvc\LTRestart.bat LTSVC.exe File opened for modification C:\Windows\LTsvc\LTErrors.txt LTSVC.exe File created C:\Windows\LTsvc\noshadow LTSVC.exe File created C:\Windows\LTSvc\LabTech.ico 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\labvnc.exe 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\nsoftware.IPWorksSSH.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\screenhooks32.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File opened for modification C:\Windows\LTSvc\LTSVC.InstallLog installutil.exe File created C:\Windows\LTsvc\noshadow LTSVC.exe File created C:\Windows\LTSvc\Interfaces.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\ICSharpCode.SharpZipLib.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\nsoftware.IPWorksSSNMP.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\nsoftware.System.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File opened for modification C:\Windows\LTsvc\LTErrors.txt LTSVC.exe File created C:\Windows\LTSvc\LTTray.exe 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\cad.exe 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\cpuidsdk64.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\nsoftware.IPWorks.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\screenhooks.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\tvnserver.exe 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\SCHook.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTsvc\ultravnc.ini LTSVC.exe File created C:\Windows\LTSvc\Interop.WODVPNCOMLib.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe File created C:\Windows\LTSvc\vnchooks.dll 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4232 CMD.exe 4456 CMD.exe 3892 CMD.exe 3876 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnserver.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3216 PING.EXE 5324 PING.EXE 3412 PING.EXE - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Sysinternals\C\EulaAccepted = "1" LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Sysinternals\PsExec LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Sysinternals\PsExec\EulaAccepted = "1" LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Sysinternals\C LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Sysinternals LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec\EulaAccepted = "1" LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\PsExec LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs LTSVC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates LTSVC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs LTSVC.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{15DD3BF6-5A11-4407-8399-A19AC10C65D0}\InprocServer32\ThreadingModel = "both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNUser.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C59A1D54-8CD7-4795-AEDD-F6F6E2DE1FE7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNMediator.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNInterface.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1B00A43-7A54-4A0F-B35D-B4334811FAA4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNInterface.1\CLSID\ = "{09DF1DCA-C076-498A-8370-AD6F878B6C6A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3607E98A-C816-486C-AEC9-A64C8FDEAB6D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1BD84436-87A4-488E-968E-E07CAB0157F8}\TypeLib\ = "{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57144698-03FD-41B6-8479-73A8EB19DDA7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{902D4CE3-EA2D-4334-BD07-FCBCD0AFBDB1}\ = "IVPNMediator" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{902D4CE3-EA2D-4334-BD07-FCBCD0AFBDB1}\ = "IVPNMediator" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.wodVPNCom\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{459C65ED-AA9C-4CF1-9A24-7685505F919A}\VersionIndependentProgID\ = "WeOnlyDo.wodVPNCom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E092B5C-795B-46BC-886A-DFFBBBC9A117}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNRelay\CLSID\ = "{3C198C98-0E27-40E4-972C-FDC656EC30D7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNInterfaces.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D101D9C-18CC-4E78-8D78-389E48478FCA}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3607E98A-C816-486C-AEC9-A64C8FDEAB6D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BA4C7B5-4941-4473-A1F5-187AD734C009}\ = "IVPNUser" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNChannels regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNChannels\CLSID\ = "{BBC521C8-2792-43FE-9C91-CCA7E8ACBCC9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNUsers\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.TCPHandler.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7A786AC-285C-4924-9E9F-2FBF97499299}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A926488-E5E7-453D-8492-18A4B64804A5}\ = "IVPNInterfaces" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A926488-E5E7-453D-8492-18A4B64804A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D415168-980F-4B2C-BFF2-DB68EC60149D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.wodVPNCom.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{459C65ED-AA9C-4CF1-9A24-7685505F919A}\TypeLib\ = "{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNChannels.1\CLSID\ = "{BBC521C8-2792-43FE-9C91-CCA7E8ACBCC9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNChannel regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNMediator\ = "VPNMediator Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09DF1DCA-C076-498A-8370-AD6F878B6C6A}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34FCE977-800B-47D3-AA58-E2B1ED957710}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{459C65ED-AA9C-4CF1-9A24-7685505F919A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNChannels.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BD84436-87A4-488E-968E-E07CAB0157F8}\TypeLib\ = "{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{902D4CE3-EA2D-4334-BD07-FCBCD0AFBDB1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D415168-980F-4B2C-BFF2-DB68EC60149D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1646101F-5EDD-456C-A734-E6E7456C7C1F}\ = "IwodVPNNotify" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNRelays\ = "VPNRelays Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3607E98A-C816-486C-AEC9-A64C8FDEAB6D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3607E98A-C816-486C-AEC9-A64C8FDEAB6D}\TypeLib\ = "{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BA4C7B5-4941-4473-A1F5-187AD734C009}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BA4C7B5-4941-4473-A1F5-187AD734C009}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D415168-980F-4B2C-BFF2-DB68EC60149D}\TypeLib\ = "{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{459C65ED-AA9C-4CF1-9A24-7685505F919A}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{459C65ED-AA9C-4CF1-9A24-7685505F919A}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBC521C8-2792-43FE-9C91-CCA7E8ACBCC9}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7BE3886B-0C12-4D87-AC0B-09A5CE4E6BD6}\ = "VPNInterfaces Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34FCE977-800B-47D3-AA58-E2B1ED957710}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CF1E24C-A9B6-45AF-8AED-13888061FB87}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8218469-6598-4D1A-83A4-7759F3740236}\TypeLib\ = "{26818C76-2CAC-4C7E-9704-E3A037D4F3DB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBC521C8-2792-43FE-9C91-CCA7E8ACBCC9}\ProgID\ = "WeOnlyDo.VPNChannels.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNRelays\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{09DF1DCA-C076-498A-8370-AD6F878B6C6A}\VersionIndependentProgID\ = "WeOnlyDo.VPNInterface" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3607E98A-C816-486C-AEC9-A64C8FDEAB6D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34FCE977-800B-47D3-AA58-E2B1ED957710}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7A786AC-285C-4924-9E9F-2FBF97499299}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1646101F-5EDD-456C-A734-E6E7456C7C1F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WeOnlyDo.VPNRelays.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D101D9C-18CC-4E78-8D78-389E48478FCA}\VersionIndependentProgID\ = "WeOnlyDo.TCPHandler" regsvr32.exe - Runs net.exe
- Runs ping.exe 1 TTPs 3 IoCs
pid Process 3216 PING.EXE 5324 PING.EXE 3412 PING.EXE - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1612 LTTray.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 1928 LTSVC.exe Token: SeDebugPrivilege 1612 LTTray.exe Token: SeDebugPrivilege 1964 LTSVC.exe Token: 33 1612 LTTray.exe Token: SeIncBasePriorityPrivilege 1612 LTTray.exe Token: 33 1612 LTTray.exe Token: SeIncBasePriorityPrivilege 1612 LTTray.exe Token: 33 1612 LTTray.exe Token: SeIncBasePriorityPrivilege 1612 LTTray.exe Token: 33 1612 LTTray.exe Token: SeIncBasePriorityPrivilege 1612 LTTray.exe Token: 33 1612 LTTray.exe Token: SeIncBasePriorityPrivilege 1612 LTTray.exe Token: 33 1612 LTTray.exe Token: SeIncBasePriorityPrivilege 1612 LTTray.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4872 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 4872 tvnserver.exe 4872 tvnserver.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe 5512 tvnserver.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 5712 wrote to memory of 5372 5712 2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe 89 PID 1928 wrote to memory of 4788 1928 LTSVC.exe 93 PID 1928 wrote to memory of 5152 1928 LTSVC.exe 98 PID 5152 wrote to memory of 4872 5152 tvnserver.exe 100 PID 1928 wrote to memory of 4260 1928 LTSVC.exe 101 PID 1928 wrote to memory of 5116 1928 LTSVC.exe 103 PID 1928 wrote to memory of 6040 1928 LTSVC.exe 105 PID 1928 wrote to memory of 4232 1928 LTSVC.exe 106 PID 1928 wrote to memory of 4456 1928 LTSVC.exe 108 PID 4232 wrote to memory of 3196 4232 CMD.exe 110 PID 4456 wrote to memory of 5720 4456 CMD.exe 111 PID 3196 wrote to memory of 1164 3196 net.exe 112 PID 1928 wrote to memory of 5516 1928 LTSVC.exe 113 PID 1928 wrote to memory of 3892 1928 LTSVC.exe 115 PID 3892 wrote to memory of 2980 3892 CMD.exe 117 PID 1928 wrote to memory of 3876 1928 LTSVC.exe 118 PID 3876 wrote to memory of 3216 3876 cmd.exe 120 PID 3876 wrote to memory of 5324 3876 cmd.exe 123 PID 3876 wrote to memory of 2496 3876 cmd.exe 124 PID 2496 wrote to memory of 4912 2496 net.exe 125 PID 3876 wrote to memory of 3412 3876 cmd.exe 127 PID 3876 wrote to memory of 3560 3876 cmd.exe 128 PID 3560 wrote to memory of 4092 3560 net.exe 129 PID 3876 wrote to memory of 1080 3876 cmd.exe 130 PID 1080 wrote to memory of 3600 1080 net.exe 131 PID 3876 wrote to memory of 5264 3876 cmd.exe 132 PID 5264 wrote to memory of 5616 5264 net.exe 133 PID 3876 wrote to memory of 4196 3876 cmd.exe 134 PID 4196 wrote to memory of 4564 4196 net.exe 135 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SoftwareSASGeneration = "3" LTSVC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_db5e56897498c56ced1f2cb84676d4bc_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\installutil.exe" /name=LTService /account=localsystem C:\Windows\LTSvc\LTSVC.exe2⤵
- Sets service image path in registry
- Drops file in Windows directory
PID:5372
-
-
C:\Windows\LTSvc\LTSVC.exe"C:\Windows\LTSvc\LTSVC.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928 -
C:\Windows\LTsvc\tvnserver.exe"C:\Windows\LTsvc\tvnserver.exe" -install -silent2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4788
-
-
C:\Windows\LTsvc\tvnserver.exe"C:\Windows\LTsvc\tvnserver.exe" -start -silent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\LTsvc\tvnserver.exe"C:\Windows\LTsvc\tvnserver.exe" -controlservice -slave3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4872
-
-
-
C:\Windows\system32\Net1.exe"Net1.exe" Stop PSEXESVC2⤵PID:4260
-
-
C:\Windows\System32\CACLS.exe"C:\Windows\System32\CACLS.exe" C:\Windows\Temp /E /G Everyone:F2⤵PID:5116
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\LTsvc\wodVPN.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:6040
-
-
C:\Windows\system32\CMD.exe"CMD.exe" /c NET Start LTSvcMon2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\System32\net.exeNET Start LTSvcMon3⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 Start LTSvcMon4⤵PID:1164
-
-
-
-
C:\Windows\system32\CMD.exe"CMD.exe" /c netsh advfirewall firewall Delete rule name="Allow NetFasTalk"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\System32\netsh.exenetsh advfirewall firewall Delete rule name="Allow NetFasTalk"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5720
-
-
-
C:\Windows\system32\BCDedit.exe"C:\Windows\system32\BCDedit.exe" /deletevalue SAFEBOOT2⤵
- Modifies boot configuration data using bcdedit
PID:5516
-
-
C:\Windows\system32\CMD.exe"CMD.exe" /c netsh advfirewall firewall Delete rule name="Allow Local VNC"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\System32\netsh.exenetsh advfirewall firewall Delete rule name="Allow Local VNC"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\LTsvc\LTRestart.bat2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\System32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3216
-
-
C:\Windows\System32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5324
-
-
C:\Windows\System32\net.exenet start LTService3⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start LTService4⤵PID:4912
-
-
-
C:\Windows\System32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3412
-
-
C:\Windows\System32\net.exenet start LTService3⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start LTService4⤵PID:4092
-
-
-
C:\Windows\System32\net.exenet start LTService3⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start LTService4⤵PID:3600
-
-
-
C:\Windows\System32\net.exenet start LTService3⤵
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start LTService4⤵PID:5616
-
-
-
C:\Windows\System32\net.exenet start LTService3⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start LTService4⤵PID:4564
-
-
-
-
C:\Windows\LTsvc\tvnserver.exe"C:\Windows\LTsvc\tvnserver.exe" -controlservice -slave1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5512
-
C:\Windows\LTsvc\tvnserver.exe"C:\Windows\LTsvc\tvnserver.exe" -service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444
-
C:\Windows\LTsvc\tvnserver.exe"C:\Windows\LTsvc\tvnserver.exe" -service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:556
-
C:\Windows\LTSvc\LTTray.exeC:\Windows\LTSvc\LTTray.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
C:\Windows\LTSvc\LTSVC.exe"C:\Windows\LTSvc\LTSVC.exe" -sLTService1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1964
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
- Size 26KB
- SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
- MD5 ff690102c64e4baa8bad0c6a7a0fcac2
- SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
- SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
- SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
- TLSH T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
- Size 834B
- SHA256 e852a91e3a5c2e2ccb590d261ffb7e96364ce2d23b2227e1a7e7a1478063869d
- MD5 ae5a16dd582afe70c9d0a93d886be511
- SHA1 936b7792ddcb54faba1ea23e2b37a87441354a6b
- SHA512 e002aaf8a89c8aae6eb04700b39057af86dfe326d03e18ffbe0f884e258b60a39bb6d2f8baff13b53a9abf8db6ce4c6d760b2e728878b706136126aa4df4fe97
- TLSH T11F01129680183061F8895F21D649ECABC9B4B30D0FD9B005A5E8C6AA5813FD45B525AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
- Size 212B
- SHA256 d0eb63ccac48674b2e55691782b6e07b118d5a272dac9f3d747574b640362327
- MD5 bba87b1a374bf5391711c5a3beb12d71
- SHA1 700ac3316f48d663a3073a27978e2f7a0ed3d6bb
- SHA512 949fd7db5459bf3316f558c28cda8147eea081a189bdaf2b0f1d92bad06ad47879cb00cd241d7a4fa273d175aebaef19832d705349f55a979c78e88cddb57a28
- TLSH T19ED08C040F394143F0664B3E5AE22707AE26AFB28541CB08177817195678F22ECB8D2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3
- Size 404B
- SHA256 37fbfdcfa6440fae85345dc11af31fa73db20141259e78f8b89955e7b8c260b4
- MD5 0d5c75ae7e69bfa3b3bf84389696de22
- SHA1 30b9cb55184a86450daffe34f76a0ca03cc6c0fb
- SHA512 d2752a87240e2d507e5f555bf91a25a39fb0fe160ee676a4f38e1842053cea3b252caf946d79c8e670e01efdc20f1a1c1fd15758c29e3f4e3d986b8a83502598
- TLSH T133E07D241EB9923CF132DE7886DBA165D44EFA12546401B985521346BE02500AC6143E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
- Size 404B
- SHA256 08664f8b7bebcfe7117bff40f0c1ba09084c839376003dbd8877b04f52c573ce
- MD5 88af556ec2173c6ea07869f3e4db1499
- SHA1 ded7ae38c5840afb645ac7b62a6c20b6d655f68f
- SHA512 a9b8c9d8395f91c17201986606e1112c490636050a3f667836dd016af6378b154b263b8b23bf8dba8271160a49527588406dec270457267553cf35fa84008a8c
- TLSH T1B0E07D181DFE51ADF0B4CE75DBD595267A17F901046003FE81C06202AA23E000CE1931
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
- Size 188B
- SHA256 9e7e6a0f9868c52c41860b786193ce028a7caca6dd158aa4982a195acd27a57a
- MD5 ac10a33fca64cdb9e149c6e872065410
- SHA1 e8865ee260ffa36fd95dd2493cbeab05dd333f5a
- SHA512 325fc0854a3ca1d8ef8e63ddad81852582dcb20fe32825d278d0a1f31d90e35db68e1fff3e85b38f778322d81a16939585a9654cb301ebff955392c0304aae9d
- TLSH T1D0C02B222BAC0201F0A5053D0C229A18EF20FF00C782D70B0F392508C938F010CF3D01
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\InstallLog.txt
- Size 1KB
- SHA256 4e9b2922325287d390d9fad964095b0ba919e6fc3a0454f462b9bd2c56a8d7a5
- MD5 1fe2703fe3b4afd9644972fff1dc0574
- SHA1 e4d9cd53c5e04aa84ec3b07deecefcd86e6330e2
- SHA512 db0fa87dbec28df4d3d40561a3c7ca3eadf0c6b93d868e887a37f1422e8f2e1202e0f77490066cc5504a798fe4e926f2bb2e3a06fdbe611116a8b0eea0c85db9
- TLSH T110218D252983579E0392737AB7262A16696FE62F3B0081BC67ED21C05C290CE573D22B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\LTSvc\Interfaces.dll
- Size 46KB
- SHA256 10ac9bea77a2c5f7b5c809dc2298f6b794767cfec23a66dfd655a2d0753867d1
- MD5 4e36b075d956b5b540b6322106c5ff65
- SHA1 f73475fe037d5caa628a65d67a6c3b5484137e2a
- SHA512 2337d6a1888a48b4ece9cce911690b37b266e5d1932f1ff6f89fe4a480ffadc7ad293f0a07217b7240f7debd1754aa75b72ca53638e434f328d35818c82074b1
- SSDEEP 768:5rOAYRA4A0Q+cnVOt4uTAmTIjBQYcmg9T3VLrNQJC:43RSnwuyA5Qw4bVLhSC
- TLSH T12523188E4B64D23ADAEA073D2817061437F0DB4172539B13AA78F17ECCA3B8D53532A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTSvc\Interop.WODVPNCOMLib.dll
- Size 64KB
- SHA256 3322bd0b66e00ab89dea46ca81a4661ccb6e7adffc3d5bd28fb308f950298297
- MD5 45c0b448a5795df48afd0885c9d58d24
- SHA1 8babdb8938ac16f2d004b8139c09eafa32420433
- SHA512 d745f138581e0f784c2d02a59a04767ba2f94cce7b2704331e281118c6903d390a4765db021e3366b2515596056b83f479f73c418b33d5c2bd4e5ae161a9ba3e
- SSDEEP 1536:nv10H2BgDy98POpILqlkXmxwTittiIGCFOgYLa6aLaotKZZBrNGOWC0G89hzg:nv10H2BgDy98POpILqlkXmxwTitti6F+
- TLSH T14153A34132586134C69D57BFC37346902370D1260A33EF877A9D76A68FA224BDA533BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTSvc\LTErrors.txt
- Size 4KB
- SHA256 1da02c1e30753682b724ed5c43a5a9794097f7f979d11a19e66e93e91bfa1ae8
- MD5 1ab82997cc456d0e9c7eb189db151b9d
- SHA1 18bdcb7927236de856dbe5b9716108a38a4e1be8
- SHA512 475a13f80cb17c8223eb431ac25aba74590d3b3770cc4a2324fd42ea3220a6d8974deb3e0e1b428244fcd971380ebb69b451fd4250a3258b7979330ea18f74a6
- SSDEEP 48:4jYejTqBj6v4jDjQjC6Dj76DjBj76Djc6Djcjc6DjF6Dj7jF6DjW6DjOjW6Dj/6m:xcvn
- TLSH T1B8A1707B1D4D28EF1AD1F624EB143A9A34641D95BC88F2D02AC4784237FAEB6F84D11D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTSvc\LTSVC.InstallLog
- Size 622B
- SHA256 20939988afe3ead0d605004ced365dd6c467cc9303f8d76185124202cc06e03a
- MD5 8188d27e23bbdbee67be2b5126885e75
- SHA1 9f22be482135eb0ed55375076026bfa898db2e35
- SHA512 929b53c5172ef9659d794e0adf7d6561fd7ec022dcf86327515d91df292667ee237ce8d8618cb05a22f47e65107b35deebd3ddcebe2fc40d39bc79cd233f688b
- TLSH T11AF042060F9D01FA457026A73F479B00A366A14C2904305B73F6496CFDFA64F9764856
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\LTSvc\LTSVC.exe
- Size 1.3MB
- SHA256 0d4bf2c1b32afa14733e4dbf891e5fcf27dfec39e4d23c897f20b91455550729
- MD5 12298df46d9d2a6ac653aa8bba5ba40c
- SHA1 54f05bc9f0126b05b919da6398d84d9796ce5e75
- SHA512 a13d687daa0518b8b41f610f424582a6eee77b9cd2a745b99c6dcd4e0b0c6fb80ffa0efe925692830b2d7f9031ce3e4e22d0425c163834a5026af4d8a47764fb
- SSDEEP 24576:KrPIABzcOzeVZhU7ESjLmDG9a/rcVFEd4s7Q7znq75LzgBdHsM:KrPIABzDCVZJSnV8/rcVFEd4IQ7znq7U
- TLSH T13555C51467E84906E9BEBBF45872D2418672BDA29663D30F298024DD2F72F48CD31B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTSvc\LTTray.exe
- Size 1.1MB
- SHA256 7ce7f619c0cf16f05ceec9eb3cc023c03d95cdc79fd4db6affc11c02fc4a5829
- MD5 add02975a4a33b302dee68996abb5b49
- SHA1 e4a042545aa25443105816f50ea8d209c78eb752
- SHA512 feeb1d53a17b90f391bf6630d41b1fe1dc80c58c5aaf3b19f4f8be54ec8371c7fdb67c3debb3d2f76b2ecd23453b8878a62019d76b1a8fdcc2b3faaf94af9eae
- SSDEEP 24576:d5vcPPFhFHzlDBttTM+e08ppfRPSiQ8+FMw+FxJyJQ313y5AFS4uQeu4vYVvj:dZc3XFTldPTM1tnpq1zMwQbVr
- TLSH T17A35AE223395D90FC47D42B8887296E953B1EE1AF616CF1F3886762DACF2A01DF01756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTSvc\LabTech.ico
- Size 1KB
- SHA256 9d135ae8b5173bb222acc82b2d8275baece610e7b96b7d301f40b51ef72b3147
- MD5 301ce33ca445a2d5f03ea7d52819ba4f
- SHA1 d8ddddc271374673d1b745d3aa1387e6f6ee872d
- SHA512 fc0d8a48f9d6d9959378298b7dd48f953ea7c5df7c586436132dea5129ccb6179bf0bc66b6268ddad2ee531bad0befbc9f71d287b36a92c1b0c37e85cc20d29b
- TLSH T1732199B899D88A9DE40E30FBA05389B33C940CC38C31605A18B17E4A3EB7013FC4655F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\LTSvc\tvnserver.exe
- Size 1.6MB
- SHA256 d1b7f6283a19724183e645f59b31fd7492141e592a4295963f13b38da4268932
- MD5 2de8a6f622b54398412c1fd66d47b1ce
- SHA1 fa891e3f3d8e5abd73f614bf7b01a760fb688bf2
- SHA512 c5fdd06398ab05b797581973281351b056cb683471bdc1f75ddea6c6796ef308bf6accccfcd9e83a35395627819727c8265c838c90a8ed1d11a790af09a10c58
- SSDEEP 49152:KgNuV9+QWViocpI4vGTztBljzTViKMV+1RJuSoHk0V:nNaGViocpI4vG3tBlhiK2+I
- TLSH T15E75BF017BEAC17BD9635270147FD31A293EBA545B3486CBB2141A1E4DB0BC1AE3639F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTSvc\wodVPN.dll
- Size 530KB
- SHA256 acc247452643079e67f90fd0e12de2ce55e6f3312f179316add2950ffdc8a0fe
- MD5 7a8df97894e705e8c17a864a4f1eeffd
- SHA1 310e00892dcf51245def210f0bf1360693f51fde
- SHA512 f55aa4342e1483ee15aaa17394a275fb997c07559a7aa220e3dcc3b83559efed82788ceda05fa0d9d6f2e80770736308f652578f6c9d76b26849fe1f63fb8de4
- SSDEEP 12288:cMz/nRn75C1VDFgkl2mYWk4d/8PSmIiWxq3B7bZ0:P5Crv2m1X/86mIP4i
- TLSH T105C44B05FAD744E5D006D13DC6F78682E7B1708B4EEC5347D259CA6A2F232A3992AF0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTsvc\LTErrors.txt
- Size 7KB
- SHA256 a792a0483cddc5a314fb209eadad74687df13f940f5fc88ca325104cb2285c1a
- MD5 d7c325fb6c62cfbb2c9f3095ea6dcc06
- SHA1 9c40efecbf566969f2566b701196ba77f1403eb3
- SHA512 1a5f24238caf3de5be0b6ce72cbaa96d8b2464d7566d600a39e2d5feded1fdfccee6ac0f507f05fbeb3e1405014ff45fe817547a2ca459a265a1260d427cec66
- SSDEEP 48:4jYejTqBj6v4jDjQjC6Dj76DjBj76Djc6Djcjc6DjF6Dj7jF6DjW6DjOjW6Dj/6u:xcvaqWw1BmWJBmapgq
- TLSH T138F103761A4D18EF0AE2B724AB153A9634251ED4FC88F2E43AC4744137EDEBAF84D15C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\LTsvc\LTRestart.bat
- Size 164B
- SHA256 10b0ece3adf6584887f368935c778ef6a3a6c6f310df759618ff5722146763ce
- MD5 02d49847bce0526308c5fbc48fc4b5f9
- SHA1 22b7b633064847870269566f8fa2989e0678d9e4
- SHA512 5f89a8ad5868642276b2fc5a492d05a5cbd760f7c424cbc5c02bb353848acf441962e842a595b2c0b58bfbe8e819d27d6caa3d86be31e399aa2fae49fb591b5a
- TLSH T1B3C00C562CC351FC1A3509448C6323235251E0CD13AE36AF72812C5648CDD7F657C054
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
- Size 212B
- SHA256 8a0bb4f820a758bb2203e4ec4bfb46a77cfe8aa2f19bca6693160705ef651c5d
- MD5 4876a1b4efe7ab384116605674ba2b5c
- SHA1 eceac9fac974c7b42ae5b5409b9ab790dae32c0a
- SHA512 63341f4092bd1aaae3a8edbe166cf3258d531a9ea121b572849a32f164bf1fded07c0706ce28f8d628b51ca723d119672f8e6c445576985ce52ef0df27af4c15
- TLSH T12CD08C001F3A4583F0666F3E1AE21717AE66AFB2C541CB082774130A463CEA1AC78C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3
- Size 404B
- SHA256 052e0a4f2d87cff54bd0f79195d38d981c2cc4c5da5182da9ee0307475117d7c
- MD5 ae6213329e8765c8836ffc5842d21410
- SHA1 03560a1100947d09a42c96e04c10176d927c94e5
- SHA512 10454c56da163c7d9692a6299e53f63b60b661b8b6bfec4fdc5d1fb34d328a884826dcaa3fa321866ae2ae9692ab69dbf17cdf356c52cd33dfea150e2ed7bc5e
- TLSH T104E07D241EBD823CF131DE7886DBA166D45EFA12546441B945521346AE025009C6643D
- MD5 SHA1 SHA512 TLSH