9427c57d1cda4d6c027d39b677024d6d3ff915fa321bc45d9c18777fe5995273

Analysis

max time kernel
12s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_9ba26ddd7d9e165e212f5e449109c450_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260930-k79frast9p
SHA256 9427c57d1cda4d6c027d39b677024d6d3ff915fa321bc45d9c18777fe5995273
MD5 9ba26ddd7d9e165e212f5e449109c450
SHA1 36d039773b82d67eaa39e4aae43200239aaf99d9
SHA512 6688eafa2617fffa15261528e0086eae3366144913ac78e2ff40c766d00f7c0f1347c30015062875e2b7734fb625fc10d660d39784aaa2dfe9e6e8864273d39b
SSDEEP 49152:ckQzAYIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scS:c6wuRD9JdOR4m+lmY/4rx8cS
TLSH
T1CD8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5692	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5956	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5220	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5420	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5428	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5204	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5832	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5516	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5940	3216	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6376	3216	schtasks.exe	91

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/1316-5236-0x0000000006730000-0x000000000673A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/1316-5241-0x0000000006D40000-0x0000000006D4C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/1316-5244-0x0000000007120000-0x000000000712C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/1316-5242-0x0000000006D70000-0x0000000006D7A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/1316-5232-0x0000000006220000-0x0000000006230000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
8460	powershell.exe
8432	powershell.exe
8416	powershell.exe
8400	powershell.exe
8388	powershell.exe
8492	powershell.exe
8476	powershell.exe
8448	powershell.exe
8356	powershell.exe
8520	powershell.exe
8504	powershell.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/1316-5236-0x0000000006730000-0x000000000673A000-memory.dmp	SmartAssembly
behavioral1/memory/1316-5241-0x0000000006D40000-0x0000000006D4C000-memory.dmp	SmartAssembly
behavioral1/memory/1316-5244-0x0000000007120000-0x000000000712C000-memory.dmp	SmartAssembly
behavioral1/memory/1316-5242-0x0000000006D70000-0x0000000006D7A000-memory.dmp	SmartAssembly
behavioral1/memory/1316-5232-0x0000000006220000-0x0000000006230000-memory.dmp	SmartAssembly

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
10196	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_9ba26ddd7d9e165e212f5e449109c450_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3696	schtasks.exe
4176	schtasks.exe
2716	schtasks.exe
4956	schtasks.exe
5956	schtasks.exe
4664	schtasks.exe
5020	schtasks.exe
3852	schtasks.exe
2268	schtasks.exe
5412	schtasks.exe
4188	schtasks.exe
5692	schtasks.exe
1148	schtasks.exe
5428	schtasks.exe
512	schtasks.exe
4448	schtasks.exe
2796	schtasks.exe
5220	schtasks.exe
5516	schtasks.exe
6376	schtasks.exe
5832	schtasks.exe
3076	schtasks.exe
5204	schtasks.exe
3392	schtasks.exe
4664	schtasks.exe
1068	schtasks.exe
3060	schtasks.exe
5420	schtasks.exe
4404	schtasks.exe
5940	schtasks.exe
1600	schtasks.exe
1684	schtasks.exe
560	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	2026-09-30_9ba26ddd7d9e165e212f5e449109c450_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_9ba26ddd7d9e165e212f5e449109c450_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_9ba26ddd7d9e165e212f5e449109c450_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lx0Ty8oJHV.bat"
  2⤵
  - Executes a command shell one-liner
  PID:10196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\MsEdgeCrashpad\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MsEdgeCrashpad\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\MsEdgeCrashpad\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\lua\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\lua\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Program Files\MsEdgeCrashpad\dwm.exe
"C:\Program Files\MsEdgeCrashpad\dwm.exe"
1⤵
PID:4800

C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe
"C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe"
1⤵
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Updates\Download\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Updates\Download\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\S-1-5-21-524788801-3318743092-4051225893-1000\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\S-1-5-21-524788801-3318743092-4051225893-1000\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\S-1-5-21-524788801-3318743092-4051225893-1000\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
"C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
1⤵
PID:2956

C:\Program Files\VideoLAN\VLC\lua\sihost.exe
"C:\Program Files\VideoLAN\VLC\lua\sihost.exe"
1⤵
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5940

C:\Program Files\Microsoft Office\Updates\Download\RuntimeBroker.exe
"C:\Program Files\Microsoft Office\Updates\Download\RuntimeBroker.exe"
1⤵
PID:5652

C:\Users\Default User\csrss.exe
"C:\Users\Default User\csrss.exe"
1⤵
PID:6212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6376

C:\Program Files\Microsoft Office\smss.exe
"C:\Program Files\Microsoft Office\smss.exe"
1⤵
PID:5984

C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
"C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
1⤵
PID:5640

C:\Users\All Users\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\S-1-5-21-524788801-3318743092-4051225893-1000\backgroundTaskHost.exe
"C:\Users\All Users\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\S-1-5-21-524788801-3318743092-4051225893-1000\backgroundTaskHost.exe"
1⤵
PID:5616

C:\Recovery\WindowsRE\SearchApp.exe
"C:\Recovery\WindowsRE\SearchApp.exe"
1⤵
PID:8864

C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
"C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Program Files\MsEdgeCrashpad\dwm.exe
Size 1.7MB
SHA256 9427c57d1cda4d6c027d39b677024d6d3ff915fa321bc45d9c18777fe5995273
MD5 9ba26ddd7d9e165e212f5e449109c450
SHA1 36d039773b82d67eaa39e4aae43200239aaf99d9
SHA512 6688eafa2617fffa15261528e0086eae3366144913ac78e2ff40c766d00f7c0f1347c30015062875e2b7734fb625fc10d660d39784aaa2dfe9e6e8864273d39b
SSDEEP 49152:ckQzAYIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scS:c6wuRD9JdOR4m+lmY/4rx8cS
TLSH
T1CD8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
Size 256KB
SHA256 0782b69082bf43f85366c0b3b0584d7a64035d3276d9eeb8d91627b6df0cb435
MD5 94e863fa99c6b3a8536b3a3e3187e140
SHA1 33dd1a484a4560e1d1ce64fc3f1117da81dd0dd5
SHA512 e110668c035799534e24d076f73358fa3ca811fd9007ca0567a2c9527f6c95df23fc814d968e7c1943b199017111a9d3a175039d78c98752d5566f010c4f2726
SSDEEP 6144:GDKW1Lgbdl0zBBvjc/0USsSAgutvhQcw0tSIXf20vo:gh1Lk70znvjccUgAgux61IP20vo
TLSH
T12544D0217181C2B3C4B7013144E6CA759E3A70710B7A95D7BADD6BBA6F203E1A7362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
Size 1.1MB
SHA256 91286fdf47e2011167b8af2749a4c6ff1e0106ce9b6ebfd3f23a0b357abc8ba9
MD5 4e27a93a8c56b084412b0103eba9b49c
SHA1 58aa855a81a11bcb424333b18c655ef6c90d80b6
SHA512 33e14ef26fa8e5fe060cf6cb6c996f1ae535c78523226f61ab4a46edf0b08886cd6d37adcb9c1d578ec4598b924786ee00cfcc5ab9928aa0910d205fc10e79e4
SSDEEP 24576:ck70zrc/gBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64RpuZ:ckQzAYIwMtuvMDVPG4JdXeR4aT6LZ
TLSH
T1023522157180C373C5F7103189D5CA745A2671B10B7AA5EFBBE8ABB22F202E5B7261CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchApp.exe

Path C:\Recovery\WindowsRE\SearchApp.exe
Size 1.1MB
SHA256 7efb36f804decea2c8fe5b8153a062e756fdbeb76ff1396b492b31e79b86d375
MD5 652e2302e6345370c199647e8bd85987
SHA1 aa59c91d64a049704d88882b29bf0001a769a6d6
SHA512 d43dcda4deefda1f6a652cfdff5f6ac3bcf0d70c0165c2b01ee0669129eeac8c411fa1b855ee027abbd6a4c2fbe6732ddba7d22961e58d973593026d45de853d
SSDEEP 24576:ck70zrc/gBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJo:ckQzAYIwMtuvMDVPG4JdXeR4aT6LQ+D
TLSH
T1214523157180D373C5F7013189D1CB746A2675B20F76A5EFB6AC6BA62F202F0B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-110-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-5244-0x0000000007120000-0x000000000712C000-memory.dmp

Download

memory/1316-2-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-3-0x00000000055D0000-0x0000000005B74000-memory.dmp

Download

memory/1316-4-0x00000000050D0000-0x000000000534A000-memory.dmp

Download

memory/1316-6-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-12-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-10-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-8-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-5-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-22-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-24-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-20-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-18-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-36-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-32-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-46-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-52-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-60-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-58-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-56-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-54-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-50-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-48-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-44-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-42-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-40-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-38-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-34-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-30-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-28-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-26-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-16-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-14-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-64-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-94-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-112-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-124-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-130-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-128-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-126-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-122-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-120-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-118-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-116-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-114-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-0-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-108-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-1-0x0000000005350000-0x00000000055CC000-memory.dmp

Download

memory/1316-102-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-106-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-98-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-96-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-92-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-90-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-88-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-86-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-84-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-100-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-78-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-82-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-80-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-76-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-70-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-68-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-75-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-72-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-66-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-62-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-1748-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-2000-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-2262-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-5228-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-5230-0x0000000002320000-0x0000000002370000-memory.dmp

Download

memory/1316-5235-0x0000000006300000-0x0000000006310000-memory.dmp

Download

memory/1316-5236-0x0000000006730000-0x000000000673A000-memory.dmp

Download

memory/1316-5238-0x0000000006770000-0x0000000006782000-memory.dmp

Download

memory/1316-5237-0x0000000006760000-0x000000000676C000-memory.dmp

Download

memory/1316-5234-0x0000000006260000-0x0000000006268000-memory.dmp

Download

memory/1316-5240-0x0000000006D30000-0x0000000006D3C000-memory.dmp

Download

memory/1316-5241-0x0000000006D40000-0x0000000006D4C000-memory.dmp

Download

memory/1316-104-0x00000000050D0000-0x0000000005344000-memory.dmp

Download

memory/1316-5247-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-5250-0x0000000007230000-0x0000000007296000-memory.dmp

Download

memory/1316-5246-0x00000000071F0000-0x00000000071FC000-memory.dmp

Download

memory/1316-5245-0x0000000007130000-0x00000000071C2000-memory.dmp

Download

memory/1316-5243-0x0000000007110000-0x0000000007118000-memory.dmp

Download

memory/1316-5242-0x0000000006D70000-0x0000000006D7A000-memory.dmp

Download

memory/1316-5239-0x00000000067A0000-0x0000000006CCC000-memory.dmp

Download

memory/1316-5233-0x00000000062E0000-0x00000000062F6000-memory.dmp

Download

memory/1316-5232-0x0000000006220000-0x0000000006230000-memory.dmp

Download

memory/1316-5231-0x0000000002380000-0x0000000002388000-memory.dmp

Download

memory/1316-5229-0x00000000022F0000-0x000000000230C000-memory.dmp

Download

memory/1316-7898-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1316-7378-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/8356-23183-0x00000000049C0000-0x00000000049F6000-memory.dmp

Download

memory/8388-23729-0x0000000005AA0000-0x00000000060C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads