Overview

overview

10

Static

static

3

Illerka.C.exe

windows10-2004-x64

10

Illerka.C.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Illerka.C.exe
  • Size 378KB
  • Sample260930-fxkmesww6l
  • SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Executes dropped EXE 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 64 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Illerka.C.exe
    "C:\Users\Admin\AppData\Local\Temp\Illerka.C.exe"
    1⤵
    • UAC bypass
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2980
    • C:\Users\Admin\AppData\Local\Temp\2719301688\M23Y66X1J45E2GD0Z86.exe
      "C:\Users\Admin\AppData\Local\Temp\2719301688\M23Y66X1J45E2GD0Z86.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:3352
    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\U87P08X8V46T1HQ1N41.exe
      "C:\Users\Admin\AppData\Local\Temp\acrocef_low\U87P08X8V46T1HQ1N41.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1832
    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\M74N43S6Y44T6PN8D31.exe
      "C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\M74N43S6Y44T6PN8D31.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4516
    • C:\Users\Admin\AppData\Local\Temp\Low\J35Y71S7W85U7KP0T20.exe
      "C:\Users\Admin\AppData\Local\Temp\Low\J35Y71S7W85U7KP0T20.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2700
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\T26B56U6L77A6AM7T35.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\T26B56U6L77A6AM7T35.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1812
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\X01O41A8F21A3OQ2T32.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\X01O41A8F21A3OQ2T32.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5300
    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\I72W11Y3X03P3UI7Z56.exe
      "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\I72W11Y3X03P3UI7Z56.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3004
    • C:\Users\Admin\AppData\Local\Temp\OneNote\Y78J74B0W10Y6WP7F31.exe
      "C:\Users\Admin\AppData\Local\Temp\OneNote\Y78J74B0W10Y6WP7F31.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3628
      • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\U18V58Z8X63Y0SY6C76.exe
        "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\U18V58Z8X63Y0SY6C76.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3284
        • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\R17K22A1Y21C7NO5C00.exe
          "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\R17K22A1Y21C7NO5C00.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • System policy modification
          PID:1964
    • C:\Users\Admin\AppData\Local\Temp\Outlook Logging\X88I52W5Z36T4XP6I12.exe
      "C:\Users\Admin\AppData\Local\Temp\Outlook Logging\X88I52W5Z36T4XP6I12.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:2596
    • C:\Users\Admin\AppData\Local\Temp\TCDC1F9.tmp\R33B52Y8Q16V4MM2G20.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC1F9.tmp\R33B52Y8Q16V4MM2G20.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1528
    • C:\Users\Admin\AppData\Local\Temp\TCDC20A.tmp\Q03L53X8D25B7EB2G56.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC20A.tmp\Q03L53X8D25B7EB2G56.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4296
    • C:\Users\Admin\AppData\Local\Temp\TCDC20C.tmp\M13A00H8J66E3BY6M82.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC20C.tmp\M13A00H8J66E3BY6M82.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3756
    • C:\Users\Admin\AppData\Local\Temp\TCDC20D.tmp\J64R23C5J08N6MV7H87.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC20D.tmp\J64R23C5J08N6MV7H87.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4352
    • C:\Users\Admin\AppData\Local\Temp\TCDC20E.tmp\Z21M77G3V24D2GR7M08.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC20E.tmp\Z21M77G3V24D2GR7M08.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3296
    • C:\Users\Admin\AppData\Local\Temp\TCDC212.tmp\A47Y10I4Y04T2WB4Z61.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC212.tmp\A47Y10I4Y04T2WB4Z61.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3816
    • C:\Users\Admin\AppData\Local\Temp\TCDC222.tmp\W18D53N0T55L2BI6K41.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC222.tmp\W18D53N0T55L2BI6K41.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:672
    • C:\Users\Admin\AppData\Local\Temp\TCDC223.tmp\A27A76G2C26T4WI1G28.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC223.tmp\A27A76G2C26T4WI1G28.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:6068
    • C:\Users\Admin\AppData\Local\Temp\TCDC226.tmp\E01M51L4W60U0KM5G16.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC226.tmp\E01M51L4W60U0KM5G16.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2632
    • C:\Users\Admin\AppData\Local\Temp\TCDC227.tmp\L56L25H8U84L8DH6P20.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC227.tmp\L56L25H8U84L8DH6P20.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:6112
    • C:\Users\Admin\AppData\Local\Temp\TCDC239.tmp\Y05W47I4D48K5HU0I78.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC239.tmp\Y05W47I4D48K5HU0I78.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4592
    • C:\Users\Admin\AppData\Local\Temp\TCDC24B.tmp\M83Q62P4W74U7DW4X73.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC24B.tmp\M83Q62P4W74U7DW4X73.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5160
    • C:\Users\Admin\AppData\Local\Temp\TCDC261.tmp\L43A63O4J03A1VL4W10.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC261.tmp\L43A63O4J03A1VL4W10.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3880
    • C:\Users\Admin\AppData\Local\Temp\TCDC262.tmp\L04Q50J0Y01P5EV2A54.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC262.tmp\L04Q50J0Y01P5EV2A54.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\TCDC264.tmp\J13E60S8U21Y3YF5Q48.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC264.tmp\J13E60S8U21Y3YF5Q48.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1676
    • C:\Users\Admin\AppData\Local\Temp\TCDC265.tmp\X42U76O0E55F1SN7O05.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC265.tmp\X42U76O0E55F1SN7O05.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5880
    • C:\Users\Admin\AppData\Local\Temp\TCDC278.tmp\M78Y76T8A87B7ES0L85.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC278.tmp\M78Y76T8A87B7ES0L85.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2872
    • C:\Users\Admin\AppData\Local\Temp\TCDC279.tmp\D68C43K3Q07E3EX8X45.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC279.tmp\D68C43K3Q07E3EX8X45.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4272
    • C:\Users\Admin\AppData\Local\Temp\TCDC27A.tmp\R15G32P2M20A0PB1U35.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC27A.tmp\R15G32P2M20A0PB1U35.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2620
    • C:\Users\Admin\AppData\Local\Temp\TCDC27B.tmp\X70Z12Q0I63J7TB3Z30.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC27B.tmp\X70Z12Q0I63J7TB3Z30.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2516
    • C:\Users\Admin\AppData\Local\Temp\TCDC27C.tmp\S32L88W7N10I8PQ8C88.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC27C.tmp\S32L88W7N10I8PQ8C88.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4288
    • C:\Users\Admin\AppData\Local\Temp\TCDC28D.tmp\H61C06S8Y55P6JY1Z56.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC28D.tmp\H61C06S8Y55P6JY1Z56.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3324
    • C:\Users\Admin\AppData\Local\Temp\TCDC28F.tmp\D64K46O6V01M3ES3L57.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC28F.tmp\D64K46O6V01M3ES3L57.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1984
    • C:\Users\Admin\AppData\Local\Temp\TCDC2A2.tmp\A65L73P8F33G2HF5C18.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2A2.tmp\A65L73P8F33G2HF5C18.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1400
    • C:\Users\Admin\AppData\Local\Temp\TCDC2A3.tmp\R10H50Y0O32Z0AC7E48.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2A3.tmp\R10H50Y0O32Z0AC7E48.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System policy modification
      PID:1540
    • C:\Users\Admin\AppData\Local\Temp\TCDC2B4.tmp\U27Y87W6U13Y1GH3V18.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2B4.tmp\U27Y87W6U13Y1GH3V18.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4588
    • C:\Users\Admin\AppData\Local\Temp\TCDC2B5.tmp\L14Q36V0V11Q4XJ2G01.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2B5.tmp\L14Q36V0V11Q4XJ2G01.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3236
    • C:\Users\Admin\AppData\Local\Temp\TCDC2C8.tmp\S87C84A1F31W3IB3Q47.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2C8.tmp\S87C84A1F31W3IB3Q47.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5528
    • C:\Users\Admin\AppData\Local\Temp\TCDC2C9.tmp\Z12J23V3H41B6SY3I35.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2C9.tmp\Z12J23V3H41B6SY3I35.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4968
    • C:\Users\Admin\AppData\Local\Temp\TCDC2CA.tmp\G75V60A5R61I4CQ4R71.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2CA.tmp\G75V60A5R61I4CQ4R71.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1048
    • C:\Users\Admin\AppData\Local\Temp\TCDC2DC.tmp\O00C08V7S71M8MN4J70.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC2DC.tmp\O00C08V7S71M8MN4J70.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:860
    • C:\Users\Admin\AppData\Local\Temp\TCDC34B.tmp\J54C84S7M41W1RF8M05.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC34B.tmp\J54C84S7M41W1RF8M05.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System policy modification
      PID:668
    • C:\Users\Admin\AppData\Local\Temp\TCDC37C.tmp\V33E42U4R00I2FP4X50.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC37C.tmp\V33E42U4R00I2FP4X50.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1976
    • C:\Users\Admin\AppData\Local\Temp\TCDC39D.tmp\J21Z77B4K45R3BS8L64.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC39D.tmp\J21Z77B4K45R3BS8L64.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3768
    • C:\Users\Admin\AppData\Local\Temp\TCDC4D8.tmp\L38Q05Y1Q16R4GX4D34.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC4D8.tmp\L38Q05Y1Q16R4GX4D34.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1752
    • C:\Users\Admin\AppData\Local\Temp\TCDC538.tmp\O47H33W8W87Q5MC0U14.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC538.tmp\O47H33W8W87Q5MC0U14.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4664
    • C:\Users\Admin\AppData\Local\Temp\TCDC549.tmp\M48I61X0G11K3PO2L55.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC549.tmp\M48I61X0G11K3PO2L55.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2708
    • C:\Users\Admin\AppData\Local\Temp\TCDC54B.tmp\T21U27C1Q31R1AG4U02.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC54B.tmp\T21U27C1Q31R1AG4U02.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5020
    • C:\Users\Admin\AppData\Local\Temp\TCDC55D.tmp\V38L45Z7W02Q2FL0L72.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC55D.tmp\V38L45Z7W02Q2FL0L72.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:296
    • C:\Users\Admin\AppData\Local\Temp\TCDC5FB.tmp\C02X02E0G23W0QD1V17.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC5FB.tmp\C02X02E0G23W0QD1V17.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5996
    • C:\Users\Admin\AppData\Local\Temp\TCDC65B.tmp\M35X18D5V20Y5HS0R56.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC65B.tmp\M35X18D5V20Y5HS0R56.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3320
    • C:\Users\Admin\AppData\Local\Temp\TCDC861.tmp\T50E47Y7X38D0QP8K44.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC861.tmp\T50E47Y7X38D0QP8K44.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4136
    • C:\Users\Admin\AppData\Local\Temp\TCDC95D.tmp\H37Z63E7P75M1MS3Y50.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC95D.tmp\H37Z63E7P75M1MS3Y50.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5060
    • C:\Users\Admin\AppData\Local\Temp\TCDC9AD.tmp\B81T63H2H45O1BP0X67.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC9AD.tmp\B81T63H2H45O1BP0X67.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5452
    • C:\Users\Admin\AppData\Local\Temp\TCDC9CE.tmp\M53H38A1B27L3YC4H88.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDC9CE.tmp\M53H38A1B27L3YC4H88.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3340
    • C:\Users\Admin\AppData\Local\Temp\TCDCBD4.tmp\D07E15J3K25E1RZ6J30.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDCBD4.tmp\D07E15J3K25E1RZ6J30.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2080
    • C:\Users\Admin\AppData\Local\Temp\TCDCC24.tmp\M21E12I8Z22G6IO5G67.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDCC24.tmp\M21E12I8Z22G6IO5G67.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1684
    • C:\Users\Admin\AppData\Local\Temp\TCDCC55.tmp\R05X82J7W56Q3LO7L63.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDCC55.tmp\R05X82J7W56Q3LO7L63.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:6128
    • C:\Users\Admin\AppData\Local\Temp\TCDCDAE.tmp\T54G55I5Z42C8BQ5T58.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDCDAE.tmp\T54G55I5Z42C8BQ5T58.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3132
    • C:\Users\Admin\AppData\Local\Temp\TCDCDD0.tmp\T13I34L8Z36G3BY4X35.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDCDD0.tmp\T13I34L8Z36G3BY4X35.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2104
    • C:\Users\Admin\AppData\Local\Temp\TCDCEBC.tmp\O56I20J8T07Q4GQ0A51.exe
      "C:\Users\Admin\AppData\Local\Temp\TCDCEBC.tmp\O56I20J8T07Q4GQ0A51.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4308
    • C:\Users\Admin\AppData\Local\Temp\VBE\O25K88M1U82U8GX8E38.exe
      "C:\Users\Admin\AppData\Local\Temp\VBE\O25K88M1U82U8GX8E38.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1712
    • C:\Users\Admin\AppData\Local\Temp\{B2E355A5-206F-49EB-9A4C-D9DB47034DD2}\J60K74K1O52E1LP3H44.exe
      "C:\Users\Admin\AppData\Local\Temp\{B2E355A5-206F-49EB-9A4C-D9DB47034DD2}\J60K74K1O52E1LP3H44.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5956
    • C:\Users\Admin\AppData\Local\Temp\{C06FE826-AED0-47BE-966B-D7731BF7041F}\A55C33J3P50V4DR2S37.exe
      "C:\Users\Admin\AppData\Local\Temp\{C06FE826-AED0-47BE-966B-D7731BF7041F}\A55C33J3P50V4DR2S37.exe"
      2⤵
      • UAC bypass
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5388

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        M23Y66X1J45E2GD0Z86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2719301688\M23Y66X1J45E2GD0Z86.exe
        • Size 378KB
        • SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1832-7-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/1832-8-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/1832-11-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/2980-2-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/2980-0-0x0000000000D70000-0x0000000000D80000-memory.dmp
        Download

        memory/2980-1-0x0000000074E32000-0x0000000074E34000-memory.dmp
        Download

        memory/2980-9-0x0000000000D70000-0x0000000000D80000-memory.dmp
        Download

        memory/2980-14-0x0000000074E32000-0x0000000074E34000-memory.dmp
        Download

        memory/2980-21-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/2980-76-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/3352-4-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/3352-5-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download

        memory/3352-13-0x0000000074E30000-0x0000000075451000-memory.dmp
        Download