Analysis
- max time kernel
84s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 08:32
General
- Target f75d4a2f092d6896958986b1c052643e99b118a156155668a259240a2e399f77.exe
- Size 10.4MB
- Sample260822-kffdlafq2w
- SHA256 f75d4a2f092d6896958986b1c052643e99b118a156155668a259240a2e399f77
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f75d4a2f092d6896958986b1c052643e99b118a156155668a259240a2e399f77.exe"C:\Users\Admin\AppData\Local\Temp\f75d4a2f092d6896958986b1c052643e99b118a156155668a259240a2e399f77.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f75d4a2f092d6896958986b1c052643e99b118a156155668a259240a2e399f77.exeC:\Users\Admin\AppData\Local\Temp\f75d4a2f092d6896958986b1c052643e99b118a156155668a259240a2e399f77.exe update lblyeomenr.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\lblyeomenr.exeC:\Users\Admin\AppData\Local\Temp\lblyeomenr.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lblyeomenr.exeC:\Users\Admin\AppData\Local\Temp\lblyeomenr.exe update tfwrzhvlum.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\tfwrzhvlum.exeC:\Users\Admin\AppData\Local\Temp\tfwrzhvlum.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tfwrzhvlum.exeC:\Users\Admin\AppData\Local\Temp\tfwrzhvlum.exe update glorhxdpox.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\glorhxdpox.exeC:\Users\Admin\AppData\Local\Temp\glorhxdpox.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\glorhxdpox.exeC:\Users\Admin\AppData\Local\Temp\glorhxdpox.exe update bfthzrmmcg.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bfthzrmmcg.exeC:\Users\Admin\AppData\Local\Temp\bfthzrmmcg.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bfthzrmmcg.exeC:\Users\Admin\AppData\Local\Temp\bfthzrmmcg.exe update oexpcyplyr.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\oexpcyplyr.exeC:\Users\Admin\AppData\Local\Temp\oexpcyplyr.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oexpcyplyr.exeC:\Users\Admin\AppData\Local\Temp\oexpcyplyr.exe update bgekzlzmnx.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bgekzlzmnx.exeC:\Users\Admin\AppData\Local\Temp\bgekzlzmnx.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bgekzlzmnx.exeC:\Users\Admin\AppData\Local\Temp\bgekzlzmnx.exe update oxjknfmbpt.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\oxjknfmbpt.exeC:\Users\Admin\AppData\Local\Temp\oxjknfmbpt.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oxjknfmbpt.exeC:\Users\Admin\AppData\Local\Temp\oxjknfmbpt.exe update yeyaclwkmo.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exeC:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exeC:\Users\Admin\AppData\Local\Temp\yeyaclwkmo.exe update bsajyaeybr.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bsajyaeybr.exeC:\Users\Admin\AppData\Local\Temp\bsajyaeybr.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bsajyaeybr.exeC:\Users\Admin\AppData\Local\Temp\bsajyaeybr.exe update vcdehkyjqy.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vcdehkyjqy.exeC:\Users\Admin\AppData\Local\Temp\vcdehkyjqy.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcdehkyjqy.exeC:\Users\Admin\AppData\Local\Temp\vcdehkyjqy.exe update qerzsdeyyy.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\qerzsdeyyy.exeC:\Users\Admin\AppData\Local\Temp\qerzsdeyyy.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qerzsdeyyy.exeC:\Users\Admin\AppData\Local\Temp\qerzsdeyyy.exe update jewqpqscwd.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\jewqpqscwd.exeC:\Users\Admin\AppData\Local\Temp\jewqpqscwd.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jewqpqscwd.exeC:\Users\Admin\AppData\Local\Temp\jewqpqscwd.exe update bwrltxlfnv.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\bwrltxlfnv.exeC:\Users\Admin\AppData\Local\Temp\bwrltxlfnv.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bwrltxlfnv.exeC:\Users\Admin\AppData\Local\Temp\bwrltxlfnv.exe update vsyrzdbljw.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\vsyrzdbljw.exeC:\Users\Admin\AppData\Local\Temp\vsyrzdbljw.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vsyrzdbljw.exeC:\Users\Admin\AppData\Local\Temp\vsyrzdbljw.exe update qyzeziltzp.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exeC:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exeC:\Users\Admin\AppData\Local\Temp\qyzeziltzp.exe update dpfkhkdbdj.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dpfkhkdbdj.exeC:\Users\Admin\AppData\Local\Temp\dpfkhkdbdj.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dpfkhkdbdj.exeC:\Users\Admin\AppData\Local\Temp\dpfkhkdbdj.exe update qgilktumnx.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\qgilktumnx.exeC:\Users\Admin\AppData\Local\Temp\qgilktumnx.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qgilktumnx.exeC:\Users\Admin\AppData\Local\Temp\qgilktumnx.exe update srlmtkhkxf.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\srlmtkhkxf.exeC:\Users\Admin\AppData\Local\Temp\srlmtkhkxf.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\srlmtkhkxf.exeC:\Users\Admin\AppData\Local\Temp\srlmtkhkxf.exe update faskvgkiht.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\faskvgkiht.exeC:\Users\Admin\AppData\Local\Temp\faskvgkiht.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faskvgkiht.exeC:\Users\Admin\AppData\Local\Temp\faskvgkiht.exe update ihryjsymfw.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ihryjsymfw.exeC:\Users\Admin\AppData\Local\Temp\ihryjsymfw.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ihryjsymfw.exeC:\Users\Admin\AppData\Local\Temp\ihryjsymfw.exe update nyabiaugsz.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\nyabiaugsz.exeC:\Users\Admin\AppData\Local\Temp\nyabiaugsz.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nyabiaugsz.exeC:\Users\Admin\AppData\Local\Temp\nyabiaugsz.exe update xfnhjjrupl.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\xfnhjjrupl.exeC:\Users\Admin\AppData\Local\Temp\xfnhjjrupl.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xfnhjjrupl.exeC:\Users\Admin\AppData\Local\Temp\xfnhjjrupl.exe update pjlvrclfnz.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\pjlvrclfnz.exeC:\Users\Admin\AppData\Local\Temp\pjlvrclfnz.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pjlvrclfnz.exeC:\Users\Admin\AppData\Local\Temp\pjlvrclfnz.exe update hhvgayeivk.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\hhvgayeivk.exeC:\Users\Admin\AppData\Local\Temp\hhvgayeivk.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hhvgayeivk.exeC:\Users\Admin\AppData\Local\Temp\hhvgayeivk.exe update pypshhlxpr.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\pypshhlxpr.exeC:\Users\Admin\AppData\Local\Temp\pypshhlxpr.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pypshhlxpr.exeC:\Users\Admin\AppData\Local\Temp\pypshhlxpr.exe update eehzwkvawa.exe27⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\eehzwkvawa.exeC:\Users\Admin\AppData\Local\Temp\eehzwkvawa.exe27⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eehzwkvawa.exeC:\Users\Admin\AppData\Local\Temp\eehzwkvawa.exe update hdjqcywexl.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\hdjqcywexl.exeC:\Users\Admin\AppData\Local\Temp\hdjqcywexl.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hdjqcywexl.exeC:\Users\Admin\AppData\Local\Temp\hdjqcywexl.exe update rqrzssretm.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\rqrzssretm.exeC:\Users\Admin\AppData\Local\Temp\rqrzssretm.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rqrzssretm.exeC:\Users\Admin\AppData\Local\Temp\rqrzssretm.exe update rgumktuxmj.exe30⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\rgumktuxmj.exeC:\Users\Admin\AppData\Local\Temp\rgumktuxmj.exe30⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rgumktuxmj.exeC:\Users\Admin\AppData\Local\Temp\rgumktuxmj.exe update oarastapmh.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\oarastapmh.exeC:\Users\Admin\AppData\Local\Temp\oarastapmh.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oarastapmh.exeC:\Users\Admin\AppData\Local\Temp\oarastapmh.exe update rlcgcxxarf.exe32⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\rlcgcxxarf.exeC:\Users\Admin\AppData\Local\Temp\rlcgcxxarf.exe32⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rlcgcxxarf.exeC:\Users\Admin\AppData\Local\Temp\rlcgcxxarf.exe update dgvxsyvsqe.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\dgvxsyvsqe.exeC:\Users\Admin\AppData\Local\Temp\dgvxsyvsqe.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\dgvxsyvsqe.exeC:\Users\Admin\AppData\Local\Temp\dgvxsyvsqe.exe update jaybokwgks.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jaybokwgks.exeC:\Users\Admin\AppData\Local\Temp\jaybokwgks.exe34⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\jaybokwgks.exeC:\Users\Admin\AppData\Local\Temp\jaybokwgks.exe update qjihqvfzqb.exe35⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\qjihqvfzqb.exeC:\Users\Admin\AppData\Local\Temp\qjihqvfzqb.exe35⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\qjihqvfzqb.exeC:\Users\Admin\AppData\Local\Temp\qjihqvfzqb.exe update ynbozsmpwa.exe36⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ynbozsmpwa.exeC:\Users\Admin\AppData\Local\Temp\ynbozsmpwa.exe36⤵
-
C:\Users\Admin\AppData\Local\Temp\ynbozsmpwa.exeC:\Users\Admin\AppData\Local\Temp\ynbozsmpwa.exe update vmelyxhkby.exe37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vmelyxhkby.exeC:\Users\Admin\AppData\Local\Temp\vmelyxhkby.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\vmelyxhkby.exeC:\Users\Admin\AppData\Local\Temp\vmelyxhkby.exe update vfsmdmbtny.exe38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vfsmdmbtny.exeC:\Users\Admin\AppData\Local\Temp\vfsmdmbtny.exe38⤵
-
C:\Users\Admin\AppData\Local\Temp\vfsmdmbtny.exeC:\Users\Admin\AppData\Local\Temp\vfsmdmbtny.exe update qagfjgalmz.exe39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qagfjgalmz.exeC:\Users\Admin\AppData\Local\Temp\qagfjgalmz.exe39⤵
-
C:\Users\Admin\AppData\Local\Temp\qagfjgalmz.exeC:\Users\Admin\AppData\Local\Temp\qagfjgalmz.exe update fnqbqqxken.exe40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fnqbqqxken.exeC:\Users\Admin\AppData\Local\Temp\fnqbqqxken.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\fnqbqqxken.exeC:\Users\Admin\AppData\Local\Temp\fnqbqqxken.exe update imrzyovfqb.exe41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\imrzyovfqb.exeC:\Users\Admin\AppData\Local\Temp\imrzyovfqb.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\imrzyovfqb.exeC:\Users\Admin\AppData\Local\Temp\imrzyovfqb.exe update vwgdmlvvvo.exe42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vwgdmlvvvo.exeC:\Users\Admin\AppData\Local\Temp\vwgdmlvvvo.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\vwgdmlvvvo.exeC:\Users\Admin\AppData\Local\Temp\vwgdmlvvvo.exe update vafrtewxub.exe43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\vafrtewxub.exeC:\Users\Admin\AppData\Local\Temp\vafrtewxub.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\vafrtewxub.exeC:\Users\Admin\AppData\Local\Temp\vafrtewxub.exe update hkspchvrmz.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exeC:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exeC:\Users\Admin\AppData\Local\Temp\hkspchvrmz.exe update falggikplq.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\falggikplq.exeC:\Users\Admin\AppData\Local\Temp\falggikplq.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\falggikplq.exeC:\Users\Admin\AppData\Local\Temp\falggikplq.exe update uqghxoorqz.exe46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uqghxoorqz.exeC:\Users\Admin\AppData\Local\Temp\uqghxoorqz.exe46⤵
-
C:\Users\Admin\AppData\Local\Temp\uqghxoorqz.exeC:\Users\Admin\AppData\Local\Temp\uqghxoorqz.exe update pxbskoniwc.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pxbskoniwc.exeC:\Users\Admin\AppData\Local\Temp\pxbskoniwc.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\pxbskoniwc.exeC:\Users\Admin\AppData\Local\Temp\pxbskoniwc.exe update slxlxwjovn.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\slxlxwjovn.exeC:\Users\Admin\AppData\Local\Temp\slxlxwjovn.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\slxlxwjovn.exeC:\Users\Admin\AppData\Local\Temp\slxlxwjovn.exe update hyhhdhnnoa.exe49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exeC:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exeC:\Users\Admin\AppData\Local\Temp\hyhhdhnnoa.exe update wocivnjpsb.exe50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wocivnjpsb.exeC:\Users\Admin\AppData\Local\Temp\wocivnjpsb.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\wocivnjpsb.exeC:\Users\Admin\AppData\Local\Temp\wocivnjpsb.exe update ehwjoihlfl.exe51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ehwjoihlfl.exeC:\Users\Admin\AppData\Local\Temp\ehwjoihlfl.exe51⤵
-
C:\Users\Admin\AppData\Local\Temp\ehwjoihlfl.exeC:\Users\Admin\AppData\Local\Temp\ehwjoihlfl.exe update rganhnnfry.exe52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rganhnnfry.exeC:\Users\Admin\AppData\Local\Temp\rganhnnfry.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\rganhnnfry.exeC:\Users\Admin\AppData\Local\Temp\rganhnnfry.exe update rzmosrlbda.exe53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rzmosrlbda.exeC:\Users\Admin\AppData\Local\Temp\rzmosrlbda.exe53⤵
-
C:\Users\Admin\AppData\Local\Temp\rzmosrlbda.exeC:\Users\Admin\AppData\Local\Temp\rzmosrlbda.exe update rzwpdglooa.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rzwpdglooa.exeC:\Users\Admin\AppData\Local\Temp\rzwpdglooa.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\rzwpdglooa.exeC:\Users\Admin\AppData\Local\Temp\rzwpdglooa.exe update mdnogbediy.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\mdnogbediy.exeC:\Users\Admin\AppData\Local\Temp\mdnogbediy.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\mdnogbediy.exeC:\Users\Admin\AppData\Local\Temp\mdnogbediy.exe update wyxzysnnhj.exe56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\wyxzysnnhj.exeC:\Users\Admin\AppData\Local\Temp\wyxzysnnhj.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\wyxzysnnhj.exeC:\Users\Admin\AppData\Local\Temp\wyxzysnnhj.exe update gymnizbsfy.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gymnizbsfy.exeC:\Users\Admin\AppData\Local\Temp\gymnizbsfy.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\gymnizbsfy.exeC:\Users\Admin\AppData\Local\Temp\gymnizbsfy.exe update tqcrvwbhsk.exe58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tqcrvwbhsk.exeC:\Users\Admin\AppData\Local\Temp\tqcrvwbhsk.exe58⤵
-
C:\Users\Admin\AppData\Local\Temp\tqcrvwbhsk.exeC:\Users\Admin\AppData\Local\Temp\tqcrvwbhsk.exe update ywjatuiyyl.exe59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ywjatuiyyl.exeC:\Users\Admin\AppData\Local\Temp\ywjatuiyyl.exe59⤵
-
C:\Users\Admin\AppData\Local\Temp\ywjatuiyyl.exeC:\Users\Admin\AppData\Local\Temp\ywjatuiyyl.exe update bzvyieknrt.exe60⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bzvyieknrt.exeC:\Users\Admin\AppData\Local\Temp\bzvyieknrt.exe60⤵
-
C:\Users\Admin\AppData\Local\Temp\bzvyieknrt.exeC:\Users\Admin\AppData\Local\Temp\bzvyieknrt.exe update akguqadrbx.exe61⤵
-
-
C:\Users\Admin\AppData\Local\Temp\akguqadrbx.exeC:\Users\Admin\AppData\Local\Temp\akguqadrbx.exe61⤵
-
C:\Users\Admin\AppData\Local\Temp\akguqadrbx.exeC:\Users\Admin\AppData\Local\Temp\akguqadrbx.exe update qtnduyboox.exe62⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qtnduyboox.exeC:\Users\Admin\AppData\Local\Temp\qtnduyboox.exe62⤵
-
C:\Users\Admin\AppData\Local\Temp\qtnduyboox.exeC:\Users\Admin\AppData\Local\Temp\qtnduyboox.exe update ogvrxpbjhv.exe63⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ogvrxpbjhv.exeC:\Users\Admin\AppData\Local\Temp\ogvrxpbjhv.exe63⤵
-
C:\Users\Admin\AppData\Local\Temp\ogvrxpbjhv.exeC:\Users\Admin\AppData\Local\Temp\ogvrxpbjhv.exe update ixhvwblrtr.exe64⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ixhvwblrtr.exeC:\Users\Admin\AppData\Local\Temp\ixhvwblrtr.exe64⤵
-
C:\Users\Admin\AppData\Local\Temp\ixhvwblrtr.exeC:\Users\Admin\AppData\Local\Temp\ixhvwblrtr.exe update ygfeiyjozs.exe65⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ygfeiyjozs.exeC:\Users\Admin\AppData\Local\Temp\ygfeiyjozs.exe65⤵
-
C:\Users\Admin\AppData\Local\Temp\ygfeiyjozs.exeC:\Users\Admin\AppData\Local\Temp\ygfeiyjozs.exe update qoqkedgsmr.exe66⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bfthzrmmcg.exe
bgekzlzmnx.exe
bsajyaeybr.exe
bwrltxlfnv.exe
dpfkhkdbdj.exe
faskvgkiht.exe
glorhxdpox.exe
ihryjsymfw.exe
jewqpqscwd.exe
lblyeomenr.exe
nyabiaugsz.exe
oexpcyplyr.exe
oxjknfmbpt.exe
qerzsdeyyy.exe
qgilktumnx.exe
qyzeziltzp.exe
srlmtkhkxf.exe
tfwrzhvlum.exe
vcdehkyjqy.exe
vsyrzdbljw.exe
xfnhjjrupl.exe
yeyaclwkmo.exe
memory/236-48-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/544-147-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1356-35-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1664-72-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1908-64-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/1992-152-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2028-56-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2068-144-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2156-88-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2156-87-0x0000000001080000-0x0000000001081000-memory.dmp
memory/2384-171-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2664-120-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2732-177-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2736-115-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2744-185-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2904-75-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/2956-179-0x0000000001070000-0x0000000001071000-memory.dmp
memory/2956-180-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3096-32-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3096-31-0x0000000001040000-0x0000000001041000-memory.dmp
memory/3168-160-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3280-3-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3280-2-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/3300-10-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/3300-11-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3340-80-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3372-59-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3436-96-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3548-19-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/3576-187-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4028-98-0x0000000001030000-0x0000000001031000-memory.dmp
memory/4028-99-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4128-8-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4372-67-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4376-167-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4376-168-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4396-43-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4548-182-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4604-112-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4636-16-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4688-155-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4724-51-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4944-107-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4952-128-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4980-40-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/4996-23-0x0000000001000000-0x0000000001001000-memory.dmp
memory/4996-24-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5100-139-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5148-83-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5148-82-0x0000000001220000-0x0000000001221000-memory.dmp
memory/5248-162-0x00000000010E0000-0x00000000010E1000-memory.dmp
memory/5248-163-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5420-131-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5420-130-0x0000000001050000-0x0000000001051000-memory.dmp
memory/5584-104-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5664-27-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5664-26-0x0000000001120000-0x0000000001121000-memory.dmp
memory/5708-175-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5896-91-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5908-136-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/5976-123-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6072-0-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/6072-1-0x0000000000400000-0x0000000000E90000-memory.dmp
memory/6132-190-0x0000000000400000-0x0000000000E90000-memory.dmp