Analysis
- max time kernel
40s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe
- Size 836KB
- Sample261001-hv7qaavye1
- SHA256 4077ada343dd6861365f7d41b51c5529b803c38d236cac7e1c1a544d460abb34
- MD5 bcd7a5861c8fe5c3020df26640394624
- SHA1 4475a9ff13c1a27b7e85eba075efaa8b2d4851e3
- SHA512 55500e60929c310b9e61fbb6bb39dee2c85ef623456475c172a1ebad9e8439d4c83a21d006c605bbda5907bcdffa6355a9c96708d8dad77b694e49e9436a0c1c
- SSDEEP 24576:aWboKNs2R0R2Wo6y+wHVa1MpkokIeR56bMxD:aWboKeulWo6/sVa1MpCIPY
- TLSH T1A705C04275D700F3DA22143114BBAB3BF5755D9A113A4E8B57ECEE7B2C22510AA3E32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/1964-36-0x00000000005B0000-0x00000000005B9000-memory.dmp family_bdaejec_backdoor behavioral2/memory/1964-63-0x00000000005B0000-0x00000000005B9000-memory.dmp family_bdaejec_backdoor - Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WyknlR.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WyknlR.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WyknlR.exe - Detects executables packed with ASPack 4 IoCs
resource yara_rule behavioral2/files/0x000d000000006908-19.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1964-20-0x00000000005B0000-0x00000000005B9000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1964-36-0x00000000005B0000-0x00000000005B9000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1964-63-0x00000000005B0000-0x00000000005B9000-memory.dmp INDICATOR_EXE_Packed_ASPack - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 59 IoCs
resource yara_rule behavioral2/memory/4372-3-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-7-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-6-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-5-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-8-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-12-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-11-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-13-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-24-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-23-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-9-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-26-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-34-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-35-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-37-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-45-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-48-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-57-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-58-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-60-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-62-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-65-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-68-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-72-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-77-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-80-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-81-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-82-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-88-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-84-0x0000000002580000-0x000000000360E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-107-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-108-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-111-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-112-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-113-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-114-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-110-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-115-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-105-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-117-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-118-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-120-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-121-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-123-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-122-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-125-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-128-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-129-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-130-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-132-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-135-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-137-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-139-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-141-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-143-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-145-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-148-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x000100000000002e-181.dat INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1964-211-0x0000000006BA0000-0x0000000007C2E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 62 IoCs
resource yara_rule behavioral2/memory/4372-3-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-7-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-6-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-5-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-10-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-8-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-12-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-11-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-13-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-24-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-23-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-9-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-26-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-34-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-35-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-37-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-43-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral2/memory/4372-45-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-48-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-57-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-58-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-60-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-62-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-65-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-68-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-72-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-77-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-80-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-81-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-82-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-103-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral2/memory/4372-88-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/4372-84-0x0000000002580000-0x000000000360E000-memory.dmp UPX behavioral2/memory/1964-109-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-107-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-108-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-111-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-112-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-113-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-114-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-110-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-115-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-105-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-117-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-118-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-120-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-121-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-123-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-122-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-125-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-128-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-129-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-130-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-132-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-135-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-137-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-139-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-141-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-143-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-145-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-148-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX behavioral2/memory/1964-211-0x0000000006BA0000-0x0000000007C2E000-memory.dmp UPX -
resource yara_rule behavioral2/files/0x000d000000006908-19.dat aspack_v212_v242 - Deletes itself 1 TTPs 1 IoCs
pid Process 1964 WyknlR.exe - Executes dropped EXE 1 IoCs
pid Process 1964 WyknlR.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WyknlR.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WyknlR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe - Enumerates connected drives 3 TTPs 30 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\O:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\R: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\I: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\J: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\G:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\J:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\Q: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\D: WyknlR.exe \??\D:\ WyknlR.exe File opened (read-only) \??\G: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\O: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\D: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\I:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\Q:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\P:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\F:\ WyknlR.exe \??\D:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\F:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\K: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\M: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\N: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\H: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\K:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\M:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\P: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe File opened (read-only) \??\L: 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\H:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\L:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe \??\N:\ 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe -
resource yara_rule behavioral2/memory/4372-3-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-7-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-6-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-5-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-10-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-8-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-12-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-11-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-13-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-24-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-23-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-9-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-26-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-34-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-35-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-37-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-45-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-48-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-57-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-58-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-60-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-62-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-65-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-68-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-72-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-77-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-80-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-81-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-82-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-88-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/4372-84-0x0000000002580000-0x000000000360E000-memory.dmp upx behavioral2/memory/1964-109-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-107-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-108-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-111-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-112-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-113-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-114-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-110-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-115-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-105-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-117-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-118-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-120-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-121-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-123-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-122-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-125-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-128-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-129-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-130-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-132-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-135-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-137-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-139-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-141-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-143-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-145-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-148-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx behavioral2/memory/1964-211-0x0000000006BA0000-0x0000000007C2E000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE WyknlR.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe WyknlR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe WyknlR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE WyknlR.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe WyknlR.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe WyknlR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE WyknlR.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe WyknlR.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe WyknlR.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe WyknlR.exe File opened for modification C:\Program Files\Windows Defender\MpDefenderCoreService.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe WyknlR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe WyknlR.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe WyknlR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe WyknlR.exe File opened for modification C:\Program Files\7-Zip\7z.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe WyknlR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe WyknlR.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe WyknlR.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe WyknlR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe WyknlR.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe WyknlR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe WyknlR.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe WyknlR.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe WyknlR.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe WyknlR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe WyknlR.exe File opened for modification C:\Program Files\Windows Mail\wab.exe WyknlR.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4556 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WyknlR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WyknlR.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WyknlR.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 1964 WyknlR.exe 1964 WyknlR.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Token: SeDebugPrivilege 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 1172 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 14 PID 4372 wrote to memory of 3044 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 44 PID 4372 wrote to memory of 3104 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 46 PID 4372 wrote to memory of 3460 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 49 PID 4372 wrote to memory of 3280 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 57 PID 4372 wrote to memory of 4384 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 59 PID 4372 wrote to memory of 4452 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 60 PID 4372 wrote to memory of 4468 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 61 PID 4372 wrote to memory of 4820 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 63 PID 4372 wrote to memory of 4936 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 64 PID 4372 wrote to memory of 5236 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 65 PID 4372 wrote to memory of 5304 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 66 PID 4372 wrote to memory of 5340 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 67 PID 4372 wrote to memory of 2684 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 80 PID 4372 wrote to memory of 2568 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 81 PID 4372 wrote to memory of 1972 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 82 PID 4372 wrote to memory of 2544 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 83 PID 4372 wrote to memory of 1964 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 89 PID 4372 wrote to memory of 1172 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 14 PID 4372 wrote to memory of 3044 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 44 PID 4372 wrote to memory of 3104 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 46 PID 4372 wrote to memory of 3460 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 49 PID 4372 wrote to memory of 3280 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 57 PID 4372 wrote to memory of 4384 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 59 PID 4372 wrote to memory of 4452 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 60 PID 4372 wrote to memory of 4468 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 61 PID 4372 wrote to memory of 4820 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 63 PID 4372 wrote to memory of 4936 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 64 PID 4372 wrote to memory of 5236 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 65 PID 4372 wrote to memory of 5304 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 66 PID 4372 wrote to memory of 5340 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 67 PID 4372 wrote to memory of 2684 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 80 PID 4372 wrote to memory of 2568 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 81 PID 4372 wrote to memory of 1972 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 82 PID 4372 wrote to memory of 2544 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 83 PID 4372 wrote to memory of 1964 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 89 PID 4372 wrote to memory of 1964 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 89 PID 4372 wrote to memory of 1172 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 14 PID 4372 wrote to memory of 3044 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 44 PID 4372 wrote to memory of 3104 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 46 PID 4372 wrote to memory of 3460 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 49 PID 4372 wrote to memory of 3280 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 57 PID 4372 wrote to memory of 4384 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 59 PID 4372 wrote to memory of 4452 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 60 PID 4372 wrote to memory of 4468 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 61 PID 4372 wrote to memory of 4820 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 63 PID 4372 wrote to memory of 4936 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 64 PID 4372 wrote to memory of 5236 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 65 PID 4372 wrote to memory of 5304 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 66 PID 4372 wrote to memory of 5340 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 67 PID 4372 wrote to memory of 2684 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 80 PID 4372 wrote to memory of 2568 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 81 PID 4372 wrote to memory of 1972 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 82 PID 4372 wrote to memory of 2544 4372 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe 83 PID 1964 wrote to memory of 1172 1964 WyknlR.exe 14 PID 1964 wrote to memory of 3044 1964 WyknlR.exe 44 PID 1964 wrote to memory of 3104 1964 WyknlR.exe 46 PID 1964 wrote to memory of 3460 1964 WyknlR.exe 49 PID 1964 wrote to memory of 3280 1964 WyknlR.exe 57 PID 1964 wrote to memory of 4384 1964 WyknlR.exe 59 PID 1964 wrote to memory of 4452 1964 WyknlR.exe 60 PID 1964 wrote to memory of 4468 1964 WyknlR.exe 61 PID 1964 wrote to memory of 4820 1964 WyknlR.exe 63 PID 1964 wrote to memory of 4936 1964 WyknlR.exe 64 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WyknlR.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3104
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3280
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4384
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4468
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4820
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4936
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5236
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5304
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5340
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2684
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_bcd7a5861c8fe5c3020df26640394624_elex_nymaim_remcos_smoke-loader_wapomi.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\WyknlR.exeC:\Users\Admin\AppData\Local\Temp\WyknlR.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4cb0519b.bat" "5⤵
- Executes a command shell one-liner
PID:4556
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:1972
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2544
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1File Deletion
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAM FILES\7-ZIP\Uninstall.exe
- Size 106KB
- SHA256 b3213e7d5109b68bcee533f91a8ff4d861954c7dc7ea2bebc49de93451096672
- MD5 0121fd66582ba0c52b97c9dacab73d0f
- SHA1 25f9afdfde1dbdb92481a8f455572eac08196656
- SHA512 2b931d0ed492f280082fe1f104115331f6be65571339fac3862f1b6dbb30f937373b4e96f53bfbe3b23a3abb64abfcd997e0e3c29ea579036f35c0bff90dbd93
- SSDEEP 3072:iaNVHXGCHy0nNZL8AgLioprTCdJGYz17gS:ia72ojL83Li2SP5
- TLSH T1BFB301578F4044F5EBFF153A249967878BB38D304CB69B2A83A0B9EF0E74941E1B6453
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KNMT30O2\k2[1].rar
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\3C0614F3.exe
- Size 1B
- SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
- MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
- SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
- SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\4cb0519b.bat
- Size 187B
- SHA256 d4c9ddcc4bf30932850f213ebd617753bc39c3e6c8a3226c6b5ad3b7d9a178fa
- MD5 08cee994ed3fde9e0320d03285a77a54
- SHA1 bd9e0a6d7d86e8046816f6d3a11dce3ef89dadcc
- SHA512 31dfc8234581bdba810292b89158b49309c51238707c1bbd429c0bc4a2fdee59c12ed30041b857e6889cdf9468e3e94f7313720380f0726cb2999caf02779a7a
- TLSH T172C012118587C66D2956501706E5714DC07658AD3B693B129B20885E61E680DF6E7341
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WyknlR.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 145d6b3bbbcbf34fb1e847ad03b457b8fc96f456bb859156785a030ad59d7bdd
- MD5 d6ac7cf7f629668878200ba85abb0a8c
- SHA1 bd0a3240e86c6e4d204601bf8e5ffb93b87fba95
- SHA512 0dd31a8a3c1f635dad7b3c9e9dcdafccee67dd97a5b6f7cb71904e85bbfaf5b850fd46cc7e9f91b240642529cd9e81601ec61c9cc334dbbd55e9387315905511
- TLSH T149D05E0E4FED11BDA046003E3178E0C67239AF11D8320F4C503967416428BE9BF7E2AE
- MD5 SHA1 SHA512 TLSH
- Path F:\ondgf.pif
- Size 100KB
- SHA256 4fd45beb5ca4ff7e319b120bd9f419179b04940fceaf5c8128630611079dce4c
- MD5 ff57f01565c91b95faac0f6b4d3d6925
- SHA1 3d4679185fb15bfbedc1299bb739b7d9e1833e1b
- SHA512 ed0e62831d558b69048463c85e2c9d049daed5828d15b9a49917168654f29b12d3bbcd72e4dbf1a8896759ece34e791406949a34ec9edc5d00a773c10ac64956
- SSDEEP 3072:Y3ndomOG3+fhEEwp6HbjqOewyor2DVxw5jdpbj:edo3G4mkHbuor2503b
- TLSH T186A30290386A022CE65F21B20B90ACA0D15FB67F83936FB241707F7B0F56D817EA1725
- MD5 SHA1 SHA512 SSDEEP TLSH