Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 13:17
General
- Target 2026-10-02_49de2929de3409bd5a934a810465338b_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261003-qjdl3azala
- SHA256 aa9208a0f4c80827028c4670044f9ecf91f567b7446ecefc8ca1985bdabbe7b4
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 5 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_49de2929de3409bd5a934a810465338b_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_49de2929de3409bd5a934a810465338b_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hegmjc.exe"C:\Users\Admin\AppData\Local\Temp\hegmjc.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hegmjc.exe"C:\Users\Admin\AppData\Local\Temp\hegmjc.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\669726.exe"C:\Users\Admin\AppData\Roaming\Download\669726.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\669726.exe"C:\Users\Admin\AppData\Roaming\Download\669726.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\756327.exe"C:\Users\Admin\AppData\Roaming\Download\756327.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\756327.exe"C:\Users\Admin\AppData\Roaming\Download\756327.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\399561.exe"C:\Users\Admin\AppData\Roaming\Download\399561.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\399561.exe"C:\Users\Admin\AppData\Roaming\Download\399561.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\796140.exe"C:\Users\Admin\AppData\Roaming\Download\796140.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\796140.exe"C:\Users\Admin\AppData\Roaming\Download\796140.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\481651.exe"C:\Users\Admin\AppData\Roaming\Download\481651.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\481651.exe"C:\Users\Admin\AppData\Roaming\Download\481651.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\576370.exe"C:\Users\Admin\AppData\Roaming\Download\576370.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\576370.exe"C:\Users\Admin\AppData\Roaming\Download\576370.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\974984.exe"C:\Users\Admin\AppData\Roaming\Download\974984.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\974984.exe"C:\Users\Admin\AppData\Roaming\Download\974984.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\678595.exe"C:\Users\Admin\AppData\Roaming\Download\678595.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\678595.exe"C:\Users\Admin\AppData\Roaming\Download\678595.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\724477.exe"C:\Users\Admin\AppData\Roaming\Download\724477.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\724477.exe"C:\Users\Admin\AppData\Roaming\Download\724477.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\019898.exe"C:\Users\Admin\AppData\Roaming\Download\019898.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\019898.exe"C:\Users\Admin\AppData\Roaming\Download\019898.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\348120.exe"C:\Users\Admin\AppData\Roaming\Download\348120.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\348120.exe"C:\Users\Admin\AppData\Roaming\Download\348120.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\749834.exe"C:\Users\Admin\AppData\Roaming\Download\749834.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\749834.exe"C:\Users\Admin\AppData\Roaming\Download\749834.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\098611.exe"C:\Users\Admin\AppData\Roaming\Download\098611.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\098611.exe"C:\Users\Admin\AppData\Roaming\Download\098611.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\589326.exe"C:\Users\Admin\AppData\Roaming\Download\589326.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\589326.exe"C:\Users\Admin\AppData\Roaming\Download\589326.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\714308.exe"C:\Users\Admin\AppData\Roaming\Download\714308.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\714308.exe"C:\Users\Admin\AppData\Roaming\Download\714308.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\073305.exe"C:\Users\Admin\AppData\Roaming\Download\073305.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\073305.exe"C:\Users\Admin\AppData\Roaming\Download\073305.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\717551.exe"C:\Users\Admin\AppData\Roaming\Download\717551.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\717551.exe"C:\Users\Admin\AppData\Roaming\Download\717551.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\952714.exe"C:\Users\Admin\AppData\Roaming\Download\952714.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\952714.exe"C:\Users\Admin\AppData\Roaming\Download\952714.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\211513.exe"C:\Users\Admin\AppData\Roaming\Download\211513.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\211513.exe"C:\Users\Admin\AppData\Roaming\Download\211513.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\547594.exe"C:\Users\Admin\AppData\Roaming\Download\547594.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\547594.exe"C:\Users\Admin\AppData\Roaming\Download\547594.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\938108.exe"C:\Users\Admin\AppData\Roaming\Download\938108.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\938108.exe"C:\Users\Admin\AppData\Roaming\Download\938108.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\228812.exe"C:\Users\Admin\AppData\Roaming\Download\228812.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\228812.exe"C:\Users\Admin\AppData\Roaming\Download\228812.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\829526.exe"C:\Users\Admin\AppData\Roaming\Download\829526.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\829526.exe"C:\Users\Admin\AppData\Roaming\Download\829526.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\075619.exe"C:\Users\Admin\AppData\Roaming\Download\075619.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\075619.exe"C:\Users\Admin\AppData\Roaming\Download\075619.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\100679.exe"C:\Users\Admin\AppData\Roaming\Download\100679.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\100679.exe"C:\Users\Admin\AppData\Roaming\Download\100679.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\001110.exe"C:\Users\Admin\AppData\Roaming\Download\001110.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\001110.exe"C:\Users\Admin\AppData\Roaming\Download\001110.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\847466.exe"C:\Users\Admin\AppData\Roaming\Download\847466.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\847466.exe"C:\Users\Admin\AppData\Roaming\Download\847466.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\072449.exe"C:\Users\Admin\AppData\Roaming\Download\072449.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\072449.exe"C:\Users\Admin\AppData\Roaming\Download\072449.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\118421.exe"C:\Users\Admin\AppData\Roaming\Download\118421.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\118421.exe"C:\Users\Admin\AppData\Roaming\Download\118421.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\603419.exe"C:\Users\Admin\AppData\Roaming\Download\603419.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\603419.exe"C:\Users\Admin\AppData\Roaming\Download\603419.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\842216.exe"C:\Users\Admin\AppData\Roaming\Download\842216.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\842216.exe"C:\Users\Admin\AppData\Roaming\Download\842216.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\233930.exe"C:\Users\Admin\AppData\Roaming\Download\233930.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\233930.exe"C:\Users\Admin\AppData\Roaming\Download\233930.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\589913.exe"C:\Users\Admin\AppData\Roaming\Download\589913.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\589913.exe"C:\Users\Admin\AppData\Roaming\Download\589913.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\979527.exe"C:\Users\Admin\AppData\Roaming\Download\979527.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\979527.exe"C:\Users\Admin\AppData\Roaming\Download\979527.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\332221.exe"C:\Users\Admin\AppData\Roaming\Download\332221.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\332221.exe"C:\Users\Admin\AppData\Roaming\Download\332221.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\767203.exe"C:\Users\Admin\AppData\Roaming\Download\767203.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\767203.exe"C:\Users\Admin\AppData\Roaming\Download\767203.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\782092.exe"C:\Users\Admin\AppData\Roaming\Download\782092.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\782092.exe"C:\Users\Admin\AppData\Roaming\Download\782092.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\031999.exe"C:\Users\Admin\AppData\Roaming\Download\031999.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\031999.exe"C:\Users\Admin\AppData\Roaming\Download\031999.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\533220.exe"C:\Users\Admin\AppData\Roaming\Download\533220.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\533220.exe"C:\Users\Admin\AppData\Roaming\Download\533220.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\133135.exe"C:\Users\Admin\AppData\Roaming\Download\133135.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\133135.exe"C:\Users\Admin\AppData\Roaming\Download\133135.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\016365.exe"C:\Users\Admin\AppData\Roaming\Download\016365.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\016365.exe"C:\Users\Admin\AppData\Roaming\Download\016365.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\305078.exe"C:\Users\Admin\AppData\Roaming\Download\305078.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\305078.exe"C:\Users\Admin\AppData\Roaming\Download\305078.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\892075.exe"C:\Users\Admin\AppData\Roaming\Download\892075.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\892075.exe"C:\Users\Admin\AppData\Roaming\Download\892075.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\886133.exe"C:\Users\Admin\AppData\Roaming\Download\886133.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\886133.exe"C:\Users\Admin\AppData\Roaming\Download\886133.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\318662.exe"C:\Users\Admin\AppData\Roaming\Download\318662.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\318662.exe"C:\Users\Admin\AppData\Roaming\Download\318662.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\429113.exe"C:\Users\Admin\AppData\Roaming\Download\429113.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\429113.exe"C:\Users\Admin\AppData\Roaming\Download\429113.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\810827.exe"C:\Users\Admin\AppData\Roaming\Download\810827.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\810827.exe"C:\Users\Admin\AppData\Roaming\Download\810827.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x358,0x7ff8cef6c188,0x7ff8cef6c194,0x7ff8cef6c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,6107230887000438655,17136257399984683672,262144 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,3193307706835765621,13413221375182007689,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,6216460849983784410,6054658351916781693,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13761654216741012380,4425951750649049114,2097152 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,22635839325131788,8296181931636376419,2097152 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,18365929191436069111,11789631782744336433,2097152 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,5497528281658392030,12583289070166070750,2097152 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,18208885412660129715,17687316302460869613,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,2056661822397782642,5381836870706800030,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,11624067596510694364,3924797542155664534,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5832,i,6659929514440129514,9730587925079879202,2097152 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16410297704228053840,1000253060682061527,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16410297704228053840,1000253060682061527,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,12912267688383657900,553308044197100048,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,15926742194575418986,9939510630786341748,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,16853814065862737414,14225144572833180588,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,6992460267855015746,3332788833663535458,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6976,i,13874309252048521380,9087222450132443565,2097152 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2703466709211594014,161727737616837582,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16935004781821194880,478236808098795341,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,15461792268288180638,16234291153883072565,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,10176550071949070205,5313025299592497000,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,9058890039228329552,17251073704589885477,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,124774644870010391,10392527558424479009,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5400,i,15450474333505612047,9597698958918722259,262144 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,9278409624827672264,1855820870128285109,524288 --field-trial-handle=2300,i,18396231835965785154,12612372874785747432,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
34076eb8-fae4-4dda-88e8-62613261b59c.tmp
4b941a80-7f38-4654-9095-6d081153442a.tmp
520693a0-99ec-4b32-8065-0cdc48f126b5.tmp
settings.dat
settings.dat
04ce004d-d286-4802-8bee-1987a3312e68.tmp
6080eb5e-edc0-45c3-907a-50a008e622b6.tmp
6896d407-7c2e-46d4-bd50-b636145b37d9.tmp
f_00006d
temp-index
the-real-index
ece7bb58-69fb-4755-891d-5bcd512376ef.tmp
28cb65b9-ba20-498a-94dd-902c3d8aec77.tmp
4e043d2c-a674-4e8f-bce2-074c1af87e47.tmp
c0411ff4-09d0-4258-95d8-e98215275523.tmp
b6c7087c-d5b8-4eb0-b919-5fb206bfbf22.tmp
cf240906-1904-4615-b73d-53f84541c92b.tmp
OperationConfig
bc72d16e-3256-41fc-acee-97b9590e1d5f.tmp
c99e9a62-d6dd-40b7-82b5-73a9805ffc93.tmp
3d4c9d51-d997-4bd6-a081-613073ec25c2.tmp
4ca42d51-4142-46c6-ac16-2366040f140e.tmp
ff6e4c33-5379-436d-b84b-8b616e757bea.tmp
451cf6e9-4069-4e82-9b7c-43cc2c07392c.tmp
hao.360[1].xml
hao.360[1].xml
1[1].png
sed_api_weather_info[1].htm
time[1].js
2e443759-cc4b-4efb-99bd-6d4cdf272622.tmp
fa95fd4f-6ea5-4fb5-a48b-ae81c588e203.tmp
hegmjc.exe
ldsajdklsajdlkjsalkda.bat
content.js
019898.exe
098611.exe
348120.exe
399561.exe
481651.exe
576370.exe
669726.exe
678595.exe
724477.exe
749834.exe
756327.exe
796140.exe
974984.exe
manifest.json
manifest.json
manifest.json
memory/2488-1218-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-963-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1042-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1134-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-759-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1181-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-992-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1092-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-448-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1272-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1355-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-1310-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2488-906-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5320-241-0x0000000000400000-0x000000000059A000-memory.dmp