24f81441ad693464a8ec9cb27f867578128e3885749a137539af1249b5e7eb3b

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe
Size 15.8MB
Sample260924-11btxatarc
SHA256 24f81441ad693464a8ec9cb27f867578128e3885749a137539af1249b5e7eb3b
MD5 cde4890e3281042437cde7994b986e98
SHA1 ea496ac8d274173520b717ea1cd53ce1121bd269
SHA512 5e51358a601941dc14b002fd533bdf495390f1240a5fcc74c84727fe5b0ecb92db27c95e8d812c49e040e722db56122a0430b8be096411626eb234e7702287e4
SSDEEP 393216:b3foCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzhZ:bPRkdObGXYztU5eyAzH
TLSH
T1F5F6AE11FBC300B0F663527185AAD33BC63B7A114532DDAFF74C9949BB33691592A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c4d1-180.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5928	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1036	powershell.exe
696	powershell.exe
5928	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe

Executes dropped EXE 8 IoCs

pid	Process
5224	OInstall.exe
5868	files.dat
680	rld87164.exe
6032	OInstall.exe
1432	oinstrun.exe
5756	fsetup.exe
6048	MicrosoftEdgeSecurity.exe
572	MicrosoftEdgeSecurity.exe

Loads dropped DLL 4 IoCs

pid	Process
1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe
1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe
1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe
1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\75E7B704DB00A0029C8173CA5173DC57_FileGrabber\data\Desktop\desktop.ini	MicrosoftEdgeSecurity.exe
File created	C:\Users\Admin\AppData\Local\Temp\75E7B704DB00A0029C8173CA5173DC57_FileGrabber\data\Documents\desktop.ini	MicrosoftEdgeSecurity.exe
File created	C:\Users\Admin\AppData\Local\Temp\75E7B704DB00A0029C8173CA5173DC57_FileGrabber\data\Downloads\desktop.ini	MicrosoftEdgeSecurity.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe	fsetup.exe
File created	C:\Windows\EdgeUpdate\fsetup.exe	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4440	cmd.exe
3588	cmd.exe
5764	cmd.exe
5692	cmd.exe
4524	cmd.exe
2032	cmd.exe
4324	cmd.exe
3228	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rld87164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5816	PING.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftEdgeSecurity.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MicrosoftEdgeSecurity.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3564	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OUTLOOK.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5816	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5660	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6092	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
6140	WMIC.exe
6140	WMIC.exe
6140	WMIC.exe
6140	WMIC.exe
2892	WMIC.exe
2892	WMIC.exe
2892	WMIC.exe
2892	WMIC.exe
5928	powershell.exe
5928	powershell.exe
1688	WMIC.exe
1688	WMIC.exe
1688	WMIC.exe
1688	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
1432	oinstrun.exe
1432	oinstrun.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
696	powershell.exe
696	powershell.exe
696	powershell.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe
6048	MicrosoftEdgeSecurity.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6140	WMIC.exe
Token: SeSecurityPrivilege	6140	WMIC.exe
Token: SeTakeOwnershipPrivilege	6140	WMIC.exe
Token: SeLoadDriverPrivilege	6140	WMIC.exe
Token: SeSystemProfilePrivilege	6140	WMIC.exe
Token: SeSystemtimePrivilege	6140	WMIC.exe
Token: SeProfSingleProcessPrivilege	6140	WMIC.exe
Token: SeIncBasePriorityPrivilege	6140	WMIC.exe
Token: SeCreatePagefilePrivilege	6140	WMIC.exe
Token: SeBackupPrivilege	6140	WMIC.exe
Token: SeRestorePrivilege	6140	WMIC.exe
Token: SeShutdownPrivilege	6140	WMIC.exe
Token: SeDebugPrivilege	6140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6140	WMIC.exe
Token: SeRemoteShutdownPrivilege	6140	WMIC.exe
Token: SeUndockPrivilege	6140	WMIC.exe
Token: SeManageVolumePrivilege	6140	WMIC.exe
Token: 33	6140	WMIC.exe
Token: 34	6140	WMIC.exe
Token: 35	6140	WMIC.exe
Token: 36	6140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6140	WMIC.exe
Token: SeSecurityPrivilege	6140	WMIC.exe
Token: SeTakeOwnershipPrivilege	6140	WMIC.exe
Token: SeLoadDriverPrivilege	6140	WMIC.exe
Token: SeSystemProfilePrivilege	6140	WMIC.exe
Token: SeSystemtimePrivilege	6140	WMIC.exe
Token: SeProfSingleProcessPrivilege	6140	WMIC.exe
Token: SeIncBasePriorityPrivilege	6140	WMIC.exe
Token: SeCreatePagefilePrivilege	6140	WMIC.exe
Token: SeBackupPrivilege	6140	WMIC.exe
Token: SeRestorePrivilege	6140	WMIC.exe
Token: SeShutdownPrivilege	6140	WMIC.exe
Token: SeDebugPrivilege	6140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6140	WMIC.exe
Token: SeRemoteShutdownPrivilege	6140	WMIC.exe
Token: SeUndockPrivilege	6140	WMIC.exe
Token: SeManageVolumePrivilege	6140	WMIC.exe
Token: 33	6140	WMIC.exe
Token: 34	6140	WMIC.exe
Token: 35	6140	WMIC.exe
Token: 36	6140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2892	WMIC.exe
Token: SeSecurityPrivilege	2892	WMIC.exe
Token: SeTakeOwnershipPrivilege	2892	WMIC.exe
Token: SeLoadDriverPrivilege	2892	WMIC.exe
Token: SeSystemProfilePrivilege	2892	WMIC.exe
Token: SeSystemtimePrivilege	2892	WMIC.exe
Token: SeProfSingleProcessPrivilege	2892	WMIC.exe
Token: SeIncBasePriorityPrivilege	2892	WMIC.exe
Token: SeCreatePagefilePrivilege	2892	WMIC.exe
Token: SeBackupPrivilege	2892	WMIC.exe
Token: SeRestorePrivilege	2892	WMIC.exe
Token: SeShutdownPrivilege	2892	WMIC.exe
Token: SeDebugPrivilege	2892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2892	WMIC.exe
Token: SeRemoteShutdownPrivilege	2892	WMIC.exe
Token: SeUndockPrivilege	2892	WMIC.exe
Token: SeManageVolumePrivilege	2892	WMIC.exe
Token: 33	2892	WMIC.exe
Token: 34	2892	WMIC.exe
Token: 35	2892	WMIC.exe
Token: 36	2892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2892	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE
6092	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 5224	1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe	89
PID 5224 wrote to memory of 5764	5224	OInstall.exe	90
PID 5224 wrote to memory of 1872	5224	OInstall.exe	91
PID 5764 wrote to memory of 6140	5764	cmd.exe	94
PID 5224 wrote to memory of 5692	5224	OInstall.exe	95
PID 5692 wrote to memory of 5868	5692	cmd.exe	97
PID 5224 wrote to memory of 4524	5224	OInstall.exe	99
PID 4524 wrote to memory of 2892	4524	cmd.exe	101
PID 5224 wrote to memory of 5928	5224	OInstall.exe	102
PID 5224 wrote to memory of 6092	5224	OInstall.exe	104
PID 5224 wrote to memory of 680	5224	OInstall.exe	105
PID 680 wrote to memory of 6032	680	rld87164.exe	107
PID 6032 wrote to memory of 984	6032	OInstall.exe	109
PID 680 wrote to memory of 2032	680	rld87164.exe	108
PID 6032 wrote to memory of 4324	6032	OInstall.exe	110
PID 4324 wrote to memory of 1688	4324	cmd.exe	114
PID 2032 wrote to memory of 5816	2032	cmd.exe	115
PID 6032 wrote to memory of 3228	6032	OInstall.exe	116
PID 6032 wrote to memory of 1432	6032	OInstall.exe	118
PID 3228 wrote to memory of 6012	3228	cmd.exe	120
PID 1452 wrote to memory of 1036	1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe	122
PID 1452 wrote to memory of 696	1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe	124
PID 1452 wrote to memory of 5756	1452	2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe	126
PID 5756 wrote to memory of 4440	5756	fsetup.exe	127
PID 4440 wrote to memory of 5660	4440	cmd.exe	129
PID 5756 wrote to memory of 6048	5756	fsetup.exe	130
PID 5756 wrote to memory of 3588	5756	fsetup.exe	131
PID 3588 wrote to memory of 3564	3588	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glasswo.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\OInstall.exe
  C:\Users\Admin\AppData\Local\Temp\OInstall.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6140
- - C:\Windows\system32\reg.exe
    "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
    3⤵
    PID:1872
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\files\files.dat
      files.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5928
- - C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
    "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\rld87164.exe
    "C:\Users\Admin\AppData\Local\Temp\rld87164.exe" "C:\Users\Admin\AppData\Local\Temp\OInstall.exe" 1000
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Users\Admin\AppData\Local\Temp\OInstall.exe
      "C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
        5⤵
        
        PID:984
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1688
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3228
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\oinstrun.exe" "C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SelfD78034.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\EdgeUpdate\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\EdgeUpdate\\fsetup.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Windows\EdgeUpdate\fsetup.exe
  C:\Windows\EdgeUpdate\\fsetup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c schtasks /create /tn "EdgeUpdate" /tr "C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "EdgeUpdate" /tr "C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5660
- - C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe
    "C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\fsetup.exe" & rmdir "C:\Windows\EdgeUpdate"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3564

C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe
C:\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe
1⤵
- Executes dropped EXE
PID:572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 ef13e03ab1ac9e85ab4d03d10f4d627fa1ddb92391f603b624ba130a2e69a823
MD5 34f670a96a4b2c483a8d89eb12f295f8
SHA1 3de271c582158c664b0dc577fa9b8a1dc6ec4669
SHA512 6dd60b765c07b7eae7b752a2b4cee12f31d92fb8c0fec8c0a9f4a778cab0b37918c140ee399248035a5dbb30e959ca291ddbf86f6a7674ec5ed942504d131998
SSDEEP 384:j1TB1GV1icGW14bdcJp0TfM+1b7rr2PnNIAbk4VRNQWle5mh6/2bhNLreBwg9:xTOfiWi2j0fM+16lIAbkIN38ubhNfyX9
TLSH
T1A572A9A8517FADC7D89112B010D602E7FBA4E08CDF755198FE27CE2B1C90FBA5B61520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 dac87a4d4b9c28b4d243c7bba2f321aa3dd175b7962cf9195b70beb00f9d8072
MD5 12bc946a23aca4e6c271e17ba62e6cd9
SHA1 2e02616e47c0215db56b1ae20f96fbb7301167c8
SHA512 96ef8c4644a02a4a7ef28f8c47fddde242e7ce9e4f8cf4789b9a999a546947b5a30c7688a8af5bbd167de66d70a72b854b00c20a128ab2777935e844ad7da3da
SSDEEP 384:GSEboT1iBGNGW16Py2G+FoUeHIlKJwTPsMYIAWLF4hj9oDqBDKFqMjyUJhJR/DHJ:a0Z6GIWYPDG+FVUJI5YIAkOj9oDMGFqW
TLSH
T12AA2D72826AF9DC7D4C222B401910BA3EBF4D049A6F151AAAF4FDE2F5C45E794F501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OInstall.exe

Path C:\Users\Admin\AppData\Local\Temp\OInstall.exe
Size 15.7MB
SHA256 2954dd074ed64fc3f99e84d4db4bd609aed6fd7e5c1e15353eb6d73ff6052c42
MD5 b7d95fe69642a95d87ef68947727413d
SHA1 83e0ddba434cc00d818c496599f4b1c0c2453a96
SHA512 a5eaf656349f5e2488101512eae902b92b7d23498b0435a4e6ca8efef2e5b81a81cc75273fa7ee9b014a2a786f293f5fc02db1e82450bc4c6821bb9bbc509b08
SSDEEP 393216:QfoCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzh:iRkdObGXYztU5eyAz
TLSH
T16CF6AE11FBC300B0F663527185AAD33BC6377A114532DEAFF74C9949BB33691592A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfD78034.bat

Path C:\Users\Admin\AppData\Local\Temp\SelfD78034.bat
Size 157B
SHA256 8ad091ee4114ac4d5ee7585baf21ea55db65c4f1b1c56dd121f4acacb993b784
MD5 baebd5617306567bad04ee8e50978bdf
SHA1 2bfdc78b191629ba86b982c74d46df0723b4212f
SHA512 acb530dffe06b270902fcfd256a697b3e2f662292b6380562a327dcf4d6042949d11571c91ee4913d488784d4506ccd2f2ae85573310f647381f55b4871a1220
TLSH
T160C080104AC7C355480881770A58914CC0B64C4E2F452710AF614C5C934341C7740E41
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zhxml4sc.edh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zhxml4sc.edh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\configure.xml
Size 1KB
SHA256 850ecfcd0beea509334e3886b14f6913b753eda48be16ea36830d343322d3b40
MD5 099e707c89fd9f051a934fc5658627d5
SHA1 8b254dd28003a30850f7665ac0d5af5350a59e65
SHA512 8bf199af08a5857f4ed9f7c90b50e618c5b04d436c6e28a99520f73de097e827cee74e09999397b32c66d216a13733b2f5772bc35da88ddb587ec81c67cbd486
TLSH
T16C31299A5E889C3C66660332F296CFC47F395917571408A170CF262B2F5166403A709F
MD5 SHA1 SHA512 TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 765KB
SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
MD5 bb5569b15d68c10b7ff2d96b45825120
SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
TLSH
T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nss7ADF.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nss7ADF.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oinstrun.exe

Path C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
Size 14KB
SHA256 4a01c55f4727b3771c2672421aa2c5c20534ad0530449ed168a16a3d33345d3d
MD5 32973232138fc6b30d913167096c059d
SHA1 d6a7cb95d5525ea3d7286749663e12c1addb3104
SHA512 ce0ca843705f7059bad14260a48647797a6cb2d84c162aa943eb090a7d18f708a3403d94f92fbc67c1b1216f941bf591f358e35fef76db34125f37595e256b9f
SSDEEP 384:t0TE7lQWycenV30bCeFBgb4kkAeZn9N9TsW0ClG6VEu2QWGrWvNUTsrwHaU:t0T0lQhUs
TLSH
T1FA62A38097EC4499F0FB4F30EDBA41029ABAFD515E75D12F0150508E1AB2B61DE7AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rld87164.exe

Path C:\Users\Admin\AppData\Local\Temp\rld87164.exe
Size 16KB
SHA256 03382bd8037a9cf6905c87b98b6768bd93fec22faf2f4092d81ac970703ea14f
MD5 fc8ec75b7b5f3a2be9fdc67ee8808afa
SHA1 e5723567f6f3d12c2eaea3d07955cf5a259c8a8f
SHA512 c83ee781775fef4f65244b108bd9ac88643340375b0a2880af9c5d44259ea2f416130c01da0279eb2683988fdf7fc1f8a91e5b013bef28ceb3a086da5ac8bc2a
SSDEEP 192:WnI7XWYyywYGoT8uiAe+jlsSUFagW+b43iyRJvaofC1upLKLw9glGfqWJJR48F8:YWGYyjuQ++SUcgxNualcpLT9wGlJM8O
TLSH
T1AB722A23EEC168F6E6D380B30BB59927DD35121153444AD7E3EC9DA93B105D0E73A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ver.txt

Path C:\Users\Admin\AppData\Local\Temp\ver.txt
Size 70KB
SHA256 b8c5c7cb6c5c9a63659e1caabc020f7a48466428453e10ae6cdd5ebf10a80b62
MD5 d14d898f65b471ce23fe7435313a2562
SHA1 bb8f23115addceed2819b4d0b3d782bd617aea96
SHA512 fba3c188a250c640d28798f15190e57fddcb5129318d2ea78aba26e6b3454bf1348f209800389ccefb0a9d806ba2051895efe69edfd8731beacacdcca47a356d
SSDEEP 1536:Mf4gqVBH8cLfmmzie0yBhECdRjjP2hjg8fY0/FnCO1av+Df6bLJyHk2IIoBWStNh:i0
TLSH
T1C5632462C5324EBB3EB4322859B08742F6F023DF12915C4B35BE1E6D4F379226275E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsetup.exe

Path C:\Windows\EdgeUpdate\fsetup.exe
Size 3.1MB
SHA256 38a5066e547b2704a1b6a49719bd72404da88b8ead21ec09bf864d469037ba31
MD5 8d9fd60eb16ea90414df3708e55ccb5b
SHA1 efe8831476702a4d96f189476600c095c5ecaae9
SHA512 0ad273de13f3c509278136e7f13005cb1cdff0927f474bda20fe23a433d58703df89d5a158c722b806f73d3841f16d6ac73a2c41aabf8ecdf726aa7e44d33719
SSDEEP 49152:won39fBZqJdqP/HYKAlE3NfT2BnaB0zy9hQqyD10Qb7DWcdw5dMLLHl4DvqrZ3gl:wS+JQg4DkNg9
TLSH
T120E59E0AA3A900EDD067C17CCE578617FB72B80523359AFB16D18D562F23BF1663A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-167-0x0000000006530000-0x000000000688B000-memory.dmp

Download

memory/696-173-0x0000000007C80000-0x0000000007D23000-memory.dmp

Download

memory/696-170-0x000000006F880000-0x000000006F8CC000-memory.dmp

Download

memory/696-169-0x0000000006F20000-0x0000000006F6C000-memory.dmp

Download

memory/1036-151-0x0000000006B60000-0x0000000006B80000-memory.dmp

Download

memory/1036-147-0x0000000007600000-0x0000000007636000-memory.dmp

Download

memory/1036-146-0x0000000006690000-0x00000000066DC000-memory.dmp

Download

memory/1036-148-0x00000000700C0000-0x000000007010C000-memory.dmp

Download

memory/1036-154-0x0000000007C30000-0x0000000007CC6000-memory.dmp

Download

memory/1036-144-0x00000000060C0000-0x000000000641B000-memory.dmp

Download

memory/1036-152-0x0000000007880000-0x0000000007923000-memory.dmp

Download

memory/1036-153-0x00000000079D0000-0x00000000079DA000-memory.dmp

Download

memory/5928-38-0x0000000007020000-0x000000000769C000-memory.dmp

Download

memory/5928-32-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/5928-28-0x00000000025C0000-0x00000000025F6000-memory.dmp

Download

memory/5928-29-0x0000000004D10000-0x000000000535A000-memory.dmp

Download

memory/5928-30-0x0000000004AE0000-0x0000000004B02000-memory.dmp

Download

memory/5928-31-0x00000000054D0000-0x0000000005536000-memory.dmp

Download

memory/5928-35-0x00000000055B0000-0x000000000590B000-memory.dmp

Download

memory/5928-36-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

Download

memory/5928-39-0x00000000069D0000-0x00000000069EA000-memory.dmp

Download

memory/5928-37-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

Download

memory/6092-53-0x00007FF8610E0000-0x00007FF8610F0000-memory.dmp

Download

memory/6092-55-0x00007FF8610E0000-0x00007FF8610F0000-memory.dmp

Download

memory/6092-54-0x00007FF8610E0000-0x00007FF8610F0000-memory.dmp

Download

memory/6092-59-0x00007FF85EDF0000-0x00007FF85EE00000-memory.dmp

Download

memory/6092-56-0x00007FF8610E0000-0x00007FF8610F0000-memory.dmp

Download

memory/6092-57-0x00007FF8610E0000-0x00007FF8610F0000-memory.dmp

Download

memory/6092-58-0x00007FF85EDF0000-0x00007FF85EE00000-memory.dmp

Download