c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc

Analysis

max time kernel
14s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
Size 3.6MB
Sample260925-mep8hsdd39
SHA256 c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc
MD5 4d1d450478d98d243a94134d47b4a7e9
SHA1 450672088a0a928f3204487f3ce4dcfbbf44a2d0
SHA512 d99ece892cd621ab19b2a775a2496e81bc54eeacd456036da6684d4923573de1ce26e1d88560e98b81afe3c91d14ecadd4d17f1a953988049c00be9fb694bc48
SSDEEP 49152:zk+SBfV2x+EUE3OU1dN5dDzS3BoLpQR1BONzzS3BoLpQR1BONYn1XR7:z7gd2x+EROU1N1I621MzI621MGf7
TLSH
T16306BE13E252A0E5E21E85744672573EEBF23D251B20A7DBDFD0FD212E326D1A63B205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1368	bcdedit.exe
2240	bcdedit.exe
4344	bcdedit.exe

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral1/memory/3936-5-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-6-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-13-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-16-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-17-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-19-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-18-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-21-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-39-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-42-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-44-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral1/memory/3936-55-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
4488	cmd.exe
2620	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	SignGuiPatcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4460	longdiequdong1.sys
4336	SignGuiPatcher.exe

Loads dropped DLL 2 IoCs

pid	Process
4312	explorer.exe
1380	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\ExpIorerFrame.dll	SignGuiPatcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
684	cmd.exe
2872	cmd.exe
2208	cmd.exe
2868	cmd.exe
4932	cmd.exe
2668	cmd.exe
716	cmd.exe
1904	cmd.exe
3236	cmd.exe
1596	cmd.exe
4324	cmd.exe
3740	cmd.exe
3372	cmd.exe
1812	cmd.exe
4560	cmd.exe
3916	cmd.exe
3508	cmd.exe
3980	cmd.exe
1184	cmd.exe
4968	cmd.exe
2648	cmd.exe
2276	cmd.exe
2968	cmd.exe
4852	cmd.exe
640	cmd.exe
1860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ab0b37ec-56f6-4a0e-a8fd-7a8bf7c2da96}\InProcServer32\ = "%SystemRoot%\\system32\\ExpIorerFrame.dll"	SignGuiPatcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{F4C1D7A9-93D7-49C0-9E68-2EFC7F548B79}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Modifies registry key 1 TTPs 17 IoCs

Modify Registry

T1112

pid	Process
4512	reg.exe
2864	reg.exe
4712	reg.exe
1800	reg.exe
3952	reg.exe
5032	reg.exe
2620	reg.exe
3968	reg.exe
2852	reg.exe
372	reg.exe
4116	reg.exe
2320	reg.exe
2912	reg.exe
4840	reg.exe
2268	reg.exe
1716	reg.exe
2492	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4336	SignGuiPatcher.exe
4336	SignGuiPatcher.exe
4336	SignGuiPatcher.exe
4336	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	4336	SignGuiPatcher.exe
Token: SeDebugPrivilege	4336	SignGuiPatcher.exe
Token: SeAssignPrimaryTokenPrivilege	4336	SignGuiPatcher.exe
Token: SeBackupPrivilege	4336	SignGuiPatcher.exe
Token: SeRestorePrivilege	4336	SignGuiPatcher.exe
Token: SeDebugPrivilege	4336	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	4336	SignGuiPatcher.exe
Token: SeTakeOwnershipPrivilege	4336	SignGuiPatcher.exe
Token: SeLoadDriverPrivilege	4336	SignGuiPatcher.exe
Token: SeSystemEnvironmentPrivilege	4336	SignGuiPatcher.exe
Token: SeManageVolumePrivilege	4336	SignGuiPatcher.exe
Token: SeSecurityPrivilege	4336	SignGuiPatcher.exe
Token: SeShutdownPrivilege	4336	SignGuiPatcher.exe
Token: SeSystemtimePrivilege	4336	SignGuiPatcher.exe
Token: SeTcbPrivilege	4336	SignGuiPatcher.exe
Token: SeIncreaseQuotaPrivilege	4336	SignGuiPatcher.exe
Token: SeAuditPrivilege	4336	SignGuiPatcher.exe
Token: SeChangeNotifyPrivilege	4336	SignGuiPatcher.exe
Token: SeUndockPrivilege	4336	SignGuiPatcher.exe
Token: SeCreateTokenPrivilege	4336	SignGuiPatcher.exe
Token: SeLockMemoryPrivilege	4336	SignGuiPatcher.exe
Token: SeCreatePagefilePrivilege	4336	SignGuiPatcher.exe
Token: SeCreatePermanentPrivilege	4336	SignGuiPatcher.exe
Token: SeSystemProfilePrivilege	4336	SignGuiPatcher.exe
Token: SeProfSingleProcessPrivilege	4336	SignGuiPatcher.exe
Token: SeCreateGlobalPrivilege	4336	SignGuiPatcher.exe
Token: 34	4336	SignGuiPatcher.exe
Token: 35	4336	SignGuiPatcher.exe
Token: SeIncBasePriorityPrivilege	4336	SignGuiPatcher.exe
Token: SeRemoteShutdownPrivilege	4336	SignGuiPatcher.exe
Token: 33	4336	SignGuiPatcher.exe
Token: 32	4336	SignGuiPatcher.exe
Token: 36	4336	SignGuiPatcher.exe
Token: 31	4336	SignGuiPatcher.exe
Token: SeEnableDelegationPrivilege	4336	SignGuiPatcher.exe
Token: SeSyncAgentPrivilege	4336	SignGuiPatcher.exe
Token: SeShutdownPrivilege	1380	explorer.exe
Token: SeCreatePagefilePrivilege	1380	explorer.exe
Token: SeShutdownPrivilege	1380	explorer.exe
Token: SeCreatePagefilePrivilege	1380	explorer.exe
Token: SeShutdownPrivilege	1380	explorer.exe
Token: SeCreatePagefilePrivilege	1380	explorer.exe
Token: SeShutdownPrivilege	1380	explorer.exe
Token: SeCreatePagefilePrivilege	1380	explorer.exe
Token: SeShutdownPrivilege	1380	explorer.exe
Token: SeCreatePagefilePrivilege	1380	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2276	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	87
PID 2276 wrote to memory of 4560	2276	cmd.exe	90
PID 4560 wrote to memory of 684	4560	cmd.exe	91
PID 3936 wrote to memory of 2968	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	101
PID 2968 wrote to memory of 4512	2968	cmd.exe	103
PID 3936 wrote to memory of 2208	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	104
PID 2208 wrote to memory of 3968	2208	cmd.exe	106
PID 3936 wrote to memory of 4852	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	107
PID 4852 wrote to memory of 3952	4852	cmd.exe	109
PID 3936 wrote to memory of 640	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	110
PID 640 wrote to memory of 5032	640	cmd.exe	112
PID 3936 wrote to memory of 2868	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	113
PID 2868 wrote to memory of 2620	2868	cmd.exe	115
PID 3936 wrote to memory of 3916	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	116
PID 3916 wrote to memory of 2852	3916	cmd.exe	118
PID 3936 wrote to memory of 3740	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	119
PID 3740 wrote to memory of 2912	3740	cmd.exe	121
PID 3936 wrote to memory of 3372	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	122
PID 3372 wrote to memory of 372	3372	cmd.exe	124
PID 3936 wrote to memory of 1860	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	125
PID 1860 wrote to memory of 2864	1860	cmd.exe	127
PID 3936 wrote to memory of 1812	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	128
PID 1812 wrote to memory of 4840	1812	cmd.exe	131
PID 3936 wrote to memory of 4324	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	132
PID 4324 wrote to memory of 4712	4324	cmd.exe	134
PID 3936 wrote to memory of 2648	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	135
PID 2648 wrote to memory of 1800	2648	cmd.exe	137
PID 3936 wrote to memory of 684	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	138
PID 684 wrote to memory of 2268	684	cmd.exe	140
PID 3936 wrote to memory of 3508	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	141
PID 3508 wrote to memory of 1716	3508	cmd.exe	143
PID 3936 wrote to memory of 2872	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	144
PID 2872 wrote to memory of 2492	2872	cmd.exe	146
PID 3936 wrote to memory of 4932	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	147
PID 4932 wrote to memory of 4116	4932	cmd.exe	149
PID 3936 wrote to memory of 2668	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	150
PID 2668 wrote to memory of 2320	2668	cmd.exe	152
PID 3936 wrote to memory of 716	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	153
PID 716 wrote to memory of 1904	716	cmd.exe	155
PID 3936 wrote to memory of 3236	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	156
PID 3236 wrote to memory of 1368	3236	cmd.exe	158
PID 3936 wrote to memory of 3980	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	159
PID 3980 wrote to memory of 2240	3980	cmd.exe	161
PID 3936 wrote to memory of 1596	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	162
PID 1596 wrote to memory of 4344	1596	cmd.exe	164
PID 3936 wrote to memory of 4488	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	165
PID 4488 wrote to memory of 2620	4488	cmd.exe	167
PID 3936 wrote to memory of 1184	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	168
PID 1184 wrote to memory of 2852	1184	cmd.exe	170
PID 3936 wrote to memory of 4336	3936	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	171
PID 4336 wrote to memory of 4840	4336	SignGuiPatcher.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240670781_60414.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240670781_60414.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240681890.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240681890.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240682437_59645.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240682437_59645.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240682437_59645.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240682437_59645.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:2852
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" /e,
    3⤵
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  PID:4968
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    PID:4432

C:\Windows\Temp\longdiequdong1.sys
C:\Windows\Temp\longdiequdong1.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Loads dropped DLL
- Modifies registry class
PID:4312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4500

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1088

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4112

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3909055 /state1:0x41c64e6d
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

AppCache134348053982934238.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134348053982934238.txt
Size 85KB
SHA256 87f5d31dc22269e3118d28225d5b7679f61f280e42d0aab5a4c3d479b18042af
MD5 f42bc8e264bf8870a06837afee2d094e
SHA1 70fc8bcefa342f694dc021054447a6ce102f251e
SHA512 3d457d016bb0b24f1aff1d62d9b573b9b0607d1bfa68725800494b50d7e298d9545ebd0980fe0abd5d685cde6665e67d4a15787798bb88cff09863e189bce494
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/iU:vYGzozuys8Eo2Rb1D
TLSH
T15D83B3A53291CBF3313966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240670781_60414.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240670781_60414.bat
Size 173B
SHA256 e278de7f885c70b284671ed3275fe57b523a783ad03b72a1737e40b479e05d29
MD5 7538d15ae8cd91780244890cfd5bc1be
SHA1 d7c4ce8bd8e53b8b688ba10399f345f0f1991afe
SHA512 ecb2a343ce5cd8be2629924aa7895159e615126d2df5a8718560227cfee51d11520df4e9802e52d972cb13eeef428a77c7051ad3194d97c229aca8450d9042e0
TLSH
T182C0C0431345CCDD5026A40BA073C14460E34DC72DC03AA0025144F8EC904C7FD0A103
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240670781_60414.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240670781_60414.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240681890.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240681890.bat
Size 71B
SHA256 df6b8ae4c8e4c95fb9fb170f5130132eb0aced028f06ebfc06d3100500303342
MD5 c43823fda44b0c0e1b54315fbb4086ef
SHA1 bd2c2caa910e07f5795eed6021a5d3293c43fbd9
SHA512 8625b9ceeb3108e279068ea9687d74effd905a49e4d42ec6536842d997deb414b91d243793da769c3bb76a8cedecba268adab7cf6487f6c977002728555e5b0e
TLSH
T178A024034045CF4C4404001741F3414CD1D10C0735405F004301C144444040DDD45701
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240681890.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240681890.txt
Size 47B
SHA256 9fea0616868155973e2b5ca5d1524359e47916e8aee14dfad123b533c737ee76
MD5 1a1ea0c1a7df5f91ecd62cda837a3273
SHA1 f358bcfc14b04949db83e04c4e181f526b3fc5f3
SHA512 666a013157c5544ef7ebad000d6a5e0f2b4020bb7e7d8792880b7c35c662b1c710e25a8893f75b8599cba5bb934c18f91a689f0f24c53b287e601475b1ae9f01
MD5 SHA1 SHA512

Submit Download

_wdkt_240682437_59645.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240682437_59645.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

ExpIorerFrame.dll

Path C:\Windows\System32\ExpIorerFrame.dll
Size 10KB
SHA256 d2bc48012c386bbde5d7440329251ae64372a680c3d62071ccb2196a7ea29f82
MD5 747d751b94b9c02371bce7d8f6d3acfe
SHA1 9707af33e3269718de4a876ad5549e2b76324ae1
SHA512 6e7bd81da11a27bef607ce8b49cbd96a52ab745d4415c6b35f8adfdb3392959134b59f8c47aa29543e7c66c7ffc380f971b1f5cf1a7aec178cd1dffe61a8bb81
SSDEEP 96:QYM4DeSVxRGAwss3z3Joc+JUjJacu88fw1kWgoFaqWwr0NxsO2:QY7JVW9V3zZoUn6wOWNHWD6H
TLSH
T1B7221A879BEC0160F2D7DBB5ACB75218DA79791A373183DF4A7007182EB9611F039B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 604KB
SHA256 bbfbf45ad7e74419238dc8e1a68cc9f702a59f54011cf9ef8ba020936203824a
MD5 ba15c2adb4123b1967b1ea449206a74a
SHA1 f7decdc9757d9499e3d58e7033e78a9bc7f5097d
SHA512 788cca68e388890d474d51e74e7763a84c874239bf437c1547939f49c631301fb46f09382c1a41dca44c66e160f1f3aca489848953467bb410ab7f425da13274
SSDEEP 12288:U0zm8DQj3sl8ZoZnAKzJbqFLgBQBP469HWFBRNYr:U0zjQj3BoNzJbigBQR1BurNYr
TLSH
T189D47C82E29115F8E1A6C179C567933BE7F3B818131296DF82E0CD272F57BD0AA39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-163-0x0000000004420000-0x0000000004421000-memory.dmp

Download

memory/3936-16-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-42-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-21-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-19-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-17-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-2-0x0000000000401000-0x0000000000402000-memory.dmp

Download

memory/3936-13-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-39-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-6-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-18-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-44-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-55-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-5-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/3936-0-0x0000000003D40000-0x0000000003D6B000-memory.dmp

Download

memory/4112-71-0x000002AD07BE0000-0x000002AD07C00000-memory.dmp

Download

memory/4112-92-0x000002AD082F0000-0x000002AD08310000-memory.dmp

Download

memory/4112-61-0x000002AD07F20000-0x000002AD07F40000-memory.dmp

Download

memory/4112-58-0x000002AD06F00000-0x000002AD07000000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads