Analysis
- max time kernel
96s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 04:39
General
- Target 2026-09-27_72e6f10fe86a43d8451a4196b6f39f37_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample260928-e927kage85
- SHA256 768b5a50e8e311f8a8e7b9ec1e843b5add1186c29d758d5b16c12042ea5ea37f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 61 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 62 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 40 IoCs
- Modifies registry class 62 IoCs
- Modifies system certificate store 2 TTPs 8 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_72e6f10fe86a43d8451a4196b6f39f37_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_72e6f10fe86a43d8451a4196b6f39f37_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ajafxn.exe"C:\Users\Admin\AppData\Local\Temp\ajafxn.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ajafxn.exe"C:\Users\Admin\AppData\Local\Temp\ajafxn.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\623768.exe"C:\Users\Admin\AppData\Roaming\Download\623768.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\623768.exe"C:\Users\Admin\AppData\Roaming\Download\623768.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\405886.exe"C:\Users\Admin\AppData\Roaming\Download\405886.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\405886.exe"C:\Users\Admin\AppData\Roaming\Download\405886.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\520485.exe"C:\Users\Admin\AppData\Roaming\Download\520485.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\520485.exe"C:\Users\Admin\AppData\Roaming\Download\520485.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\059384.exe"C:\Users\Admin\AppData\Roaming\Download\059384.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\059384.exe"C:\Users\Admin\AppData\Roaming\Download\059384.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\726545.exe"C:\Users\Admin\AppData\Roaming\Download\726545.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\726545.exe"C:\Users\Admin\AppData\Roaming\Download\726545.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\815284.exe"C:\Users\Admin\AppData\Roaming\Download\815284.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\815284.exe"C:\Users\Admin\AppData\Roaming\Download\815284.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\993038.exe"C:\Users\Admin\AppData\Roaming\Download\993038.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\993038.exe"C:\Users\Admin\AppData\Roaming\Download\993038.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\807528.exe"C:\Users\Admin\AppData\Roaming\Download\807528.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\807528.exe"C:\Users\Admin\AppData\Roaming\Download\807528.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\440764.exe"C:\Users\Admin\AppData\Roaming\Download\440764.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\440764.exe"C:\Users\Admin\AppData\Roaming\Download\440764.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\735031.exe"C:\Users\Admin\AppData\Roaming\Download\735031.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\735031.exe"C:\Users\Admin\AppData\Roaming\Download\735031.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\749620.exe"C:\Users\Admin\AppData\Roaming\Download\749620.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\749620.exe"C:\Users\Admin\AppData\Roaming\Download\749620.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\140343.exe"C:\Users\Admin\AppData\Roaming\Download\140343.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\140343.exe"C:\Users\Admin\AppData\Roaming\Download\140343.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\947780.exe"C:\Users\Admin\AppData\Roaming\Download\947780.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\947780.exe"C:\Users\Admin\AppData\Roaming\Download\947780.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\193771.exe"C:\Users\Admin\AppData\Roaming\Download\193771.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\193771.exe"C:\Users\Admin\AppData\Roaming\Download\193771.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\483365.exe"C:\Users\Admin\AppData\Roaming\Download\483365.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\483365.exe"C:\Users\Admin\AppData\Roaming\Download\483365.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\940264.exe"C:\Users\Admin\AppData\Roaming\Download\940264.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\940264.exe"C:\Users\Admin\AppData\Roaming\Download\940264.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\444793.exe"C:\Users\Admin\AppData\Roaming\Download\444793.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\444793.exe"C:\Users\Admin\AppData\Roaming\Download\444793.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\041128.exe"C:\Users\Admin\AppData\Roaming\Download\041128.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\041128.exe"C:\Users\Admin\AppData\Roaming\Download\041128.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\764152.exe"C:\Users\Admin\AppData\Roaming\Download\764152.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\764152.exe"C:\Users\Admin\AppData\Roaming\Download\764152.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\878408.exe"C:\Users\Admin\AppData\Roaming\Download\878408.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\878408.exe"C:\Users\Admin\AppData\Roaming\Download\878408.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\372939.exe"C:\Users\Admin\AppData\Roaming\Download\372939.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\372939.exe"C:\Users\Admin\AppData\Roaming\Download\372939.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\902468.exe"C:\Users\Admin\AppData\Roaming\Download\902468.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\902468.exe"C:\Users\Admin\AppData\Roaming\Download\902468.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\406097.exe"C:\Users\Admin\AppData\Roaming\Download\406097.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\406097.exe"C:\Users\Admin\AppData\Roaming\Download\406097.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\652979.exe"C:\Users\Admin\AppData\Roaming\Download\652979.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\652979.exe"C:\Users\Admin\AppData\Roaming\Download\652979.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\081859.exe"C:\Users\Admin\AppData\Roaming\Download\081859.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\081859.exe"C:\Users\Admin\AppData\Roaming\Download\081859.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\237739.exe"C:\Users\Admin\AppData\Roaming\Download\237739.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\237739.exe"C:\Users\Admin\AppData\Roaming\Download\237739.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\730360.exe"C:\Users\Admin\AppData\Roaming\Download\730360.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\730360.exe"C:\Users\Admin\AppData\Roaming\Download\730360.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\232899.exe"C:\Users\Admin\AppData\Roaming\Download\232899.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\232899.exe"C:\Users\Admin\AppData\Roaming\Download\232899.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\078235.exe"C:\Users\Admin\AppData\Roaming\Download\078235.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\078235.exe"C:\Users\Admin\AppData\Roaming\Download\078235.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\082382.exe"C:\Users\Admin\AppData\Roaming\Download\082382.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\082382.exe"C:\Users\Admin\AppData\Roaming\Download\082382.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\472095.exe"C:\Users\Admin\AppData\Roaming\Download\472095.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\472095.exe"C:\Users\Admin\AppData\Roaming\Download\472095.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\973709.exe"C:\Users\Admin\AppData\Roaming\Download\973709.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\973709.exe"C:\Users\Admin\AppData\Roaming\Download\973709.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\202708.exe"C:\Users\Admin\AppData\Roaming\Download\202708.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\202708.exe"C:\Users\Admin\AppData\Roaming\Download\202708.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\704117.exe"C:\Users\Admin\AppData\Roaming\Download\704117.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\704117.exe"C:\Users\Admin\AppData\Roaming\Download\704117.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\428648.exe"C:\Users\Admin\AppData\Roaming\Download\428648.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\428648.exe"C:\Users\Admin\AppData\Roaming\Download\428648.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\898362.exe"C:\Users\Admin\AppData\Roaming\Download\898362.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\898362.exe"C:\Users\Admin\AppData\Roaming\Download\898362.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\944442.exe"C:\Users\Admin\AppData\Roaming\Download\944442.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\944442.exe"C:\Users\Admin\AppData\Roaming\Download\944442.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\403322.exe"C:\Users\Admin\AppData\Roaming\Download\403322.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\403322.exe"C:\Users\Admin\AppData\Roaming\Download\403322.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\905850.exe"C:\Users\Admin\AppData\Roaming\Download\905850.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\905850.exe"C:\Users\Admin\AppData\Roaming\Download\905850.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\295565.exe"C:\Users\Admin\AppData\Roaming\Download\295565.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\295565.exe"C:\Users\Admin\AppData\Roaming\Download\295565.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\421547.exe"C:\Users\Admin\AppData\Roaming\Download\421547.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\421547.exe"C:\Users\Admin\AppData\Roaming\Download\421547.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\012151.exe"C:\Users\Admin\AppData\Roaming\Download\012151.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\012151.exe"C:\Users\Admin\AppData\Roaming\Download\012151.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\312866.exe"C:\Users\Admin\AppData\Roaming\Download\312866.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\312866.exe"C:\Users\Admin\AppData\Roaming\Download\312866.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\558056.exe"C:\Users\Admin\AppData\Roaming\Download\558056.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\558056.exe"C:\Users\Admin\AppData\Roaming\Download\558056.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\884939.exe"C:\Users\Admin\AppData\Roaming\Download\884939.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\884939.exe"C:\Users\Admin\AppData\Roaming\Download\884939.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\143808.exe"C:\Users\Admin\AppData\Roaming\Download\143808.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\143808.exe"C:\Users\Admin\AppData\Roaming\Download\143808.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc49c7c188,0x7ffc49c7c194,0x7ffc49c7c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7345130971717438796,4077562816796568849,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,6965645827818642560,4542115307222413779,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7064496006012801111,14728132398503064675,262144 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,761631051893239800,7546163778023954510,2097152 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,1659147189166623870,12506420601764253624,2097152 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,16785377388068650500,6192604045295140998,2097152 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,13168898478258231478,15168978834958423914,2097152 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,11240883347955040404,15838341792968174871,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,16006897614109677087,11062246194301649292,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,2155435909091163357,8102891218810442305,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5988,i,8596301022707395823,916353480645308758,2097152 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9893201753654645519,5432724885364151060,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9893201753654645519,5432724885364151060,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,5162450952994661168,12904695581719278688,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,13053938807800118164,4249601476036910200,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,12387099980463979150,11524624908728113279,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,14880666702143018095,8496855984536030700,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6496,i,11911656217514439126,11049554294130511927,2097152 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,3720574690496441886,6377497847793289017,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,9511260692157785668,11471321895114915953,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,706972614537667269,9254680261891748868,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,770528859535692548,1211060894623527170,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,4987541973038745309,5845100321339579147,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,16616361874184852249,12379556211224573965,262144 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,4767374256684930018,5093096240027311848,524288 --field-trial-handle=2536,i,12350016768757531240,7240373227589190656,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_000069
temp-index
the-real-index~RFe5a5e8c.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
b6e3f3df-27cc-49a2-8b2c-2e5fc041bf59.tmp
Local State
Local State
Local State
Local State
metadata.json
metadata.json
e8e7e2bf-1cbd-4098-b823-7b11d58dec59.tmp
hao.360[1].xml
QHCmHelp1.0.0.1[1].cab
time[1].js
QHComHelper.inf
QHComHelper.ocx
ajafxn.exe
ldsajdklsajdlkjsalkda.bat
content_new.js
059384.exe
140343.exe
405886.exe
440764.exe
520485.exe
623768.exe
726545.exe
735031.exe
749620.exe
807528.exe
815284.exe
947780.exe
993038.exe
memory/4604-246-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4604-634-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4604-1092-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4604-1121-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4604-1167-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4604-791-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4604-1213-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5404-141-0x0000000000400000-0x000000000059A000-memory.dmp