Analysis
- max time kernel
114s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
18/10/2026, 22:22
General
- Target 2026-10-17_a59b63454ee577c6c60054e0db12e89a_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261018-2adfgsch38
- SHA256 939b8d0930655cd7a40f6bb83e17e7d75cff3cea0c2b98ccd01946d6835d837e
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-17_a59b63454ee577c6c60054e0db12e89a_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-17_a59b63454ee577c6c60054e0db12e89a_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\swadfe.exe"C:\Users\Admin\AppData\Local\Temp\swadfe.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swadfe.exe"C:\Users\Admin\AppData\Local\Temp\swadfe.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\656575.exe"C:\Users\Admin\AppData\Roaming\Download\656575.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\656575.exe"C:\Users\Admin\AppData\Roaming\Download\656575.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\882802.exe"C:\Users\Admin\AppData\Roaming\Download\882802.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\882802.exe"C:\Users\Admin\AppData\Roaming\Download\882802.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\622954.exe"C:\Users\Admin\AppData\Roaming\Download\622954.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\622954.exe"C:\Users\Admin\AppData\Roaming\Download\622954.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\987394.exe"C:\Users\Admin\AppData\Roaming\Download\987394.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\987394.exe"C:\Users\Admin\AppData\Roaming\Download\987394.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\826556.exe"C:\Users\Admin\AppData\Roaming\Download\826556.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\826556.exe"C:\Users\Admin\AppData\Roaming\Download\826556.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\431782.exe"C:\Users\Admin\AppData\Roaming\Download\431782.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\431782.exe"C:\Users\Admin\AppData\Roaming\Download\431782.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\821496.exe"C:\Users\Admin\AppData\Roaming\Download\821496.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\821496.exe"C:\Users\Admin\AppData\Roaming\Download\821496.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\070314.exe"C:\Users\Admin\AppData\Roaming\Download\070314.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\070314.exe"C:\Users\Admin\AppData\Roaming\Download\070314.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\373545.exe"C:\Users\Admin\AppData\Roaming\Download\373545.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\373545.exe"C:\Users\Admin\AppData\Roaming\Download\373545.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\875166.exe"C:\Users\Admin\AppData\Roaming\Download\875166.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\875166.exe"C:\Users\Admin\AppData\Roaming\Download\875166.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\600402.exe"C:\Users\Admin\AppData\Roaming\Download\600402.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\600402.exe"C:\Users\Admin\AppData\Roaming\Download\600402.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\062226.exe"C:\Users\Admin\AppData\Roaming\Download\062226.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\062226.exe"C:\Users\Admin\AppData\Roaming\Download\062226.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\461830.exe"C:\Users\Admin\AppData\Roaming\Download\461830.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\461830.exe"C:\Users\Admin\AppData\Roaming\Download\461830.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\413797.exe"C:\Users\Admin\AppData\Roaming\Download\413797.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\413797.exe"C:\Users\Admin\AppData\Roaming\Download\413797.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\668970.exe"C:\Users\Admin\AppData\Roaming\Download\668970.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\668970.exe"C:\Users\Admin\AppData\Roaming\Download\668970.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\160209.exe"C:\Users\Admin\AppData\Roaming\Download\160209.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\160209.exe"C:\Users\Admin\AppData\Roaming\Download\160209.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\706655.exe"C:\Users\Admin\AppData\Roaming\Download\706655.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\706655.exe"C:\Users\Admin\AppData\Roaming\Download\706655.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\155522.exe"C:\Users\Admin\AppData\Roaming\Download\155522.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\155522.exe"C:\Users\Admin\AppData\Roaming\Download\155522.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\404521.exe"C:\Users\Admin\AppData\Roaming\Download\404521.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\404521.exe"C:\Users\Admin\AppData\Roaming\Download\404521.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\047777.exe"C:\Users\Admin\AppData\Roaming\Download\047777.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\047777.exe"C:\Users\Admin\AppData\Roaming\Download\047777.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\609461.exe"C:\Users\Admin\AppData\Roaming\Download\609461.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\609461.exe"C:\Users\Admin\AppData\Roaming\Download\609461.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\245816.exe"C:\Users\Admin\AppData\Roaming\Download\245816.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\245816.exe"C:\Users\Admin\AppData\Roaming\Download\245816.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\239972.exe"C:\Users\Admin\AppData\Roaming\Download\239972.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\239972.exe"C:\Users\Admin\AppData\Roaming\Download\239972.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\839896.exe"C:\Users\Admin\AppData\Roaming\Download\839896.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\839896.exe"C:\Users\Admin\AppData\Roaming\Download\839896.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\975779.exe"C:\Users\Admin\AppData\Roaming\Download\975779.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\975779.exe"C:\Users\Admin\AppData\Roaming\Download\975779.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\374463.exe"C:\Users\Admin\AppData\Roaming\Download\374463.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\374463.exe"C:\Users\Admin\AppData\Roaming\Download\374463.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\709444.exe"C:\Users\Admin\AppData\Roaming\Download\709444.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\709444.exe"C:\Users\Admin\AppData\Roaming\Download\709444.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\714052.exe"C:\Users\Admin\AppData\Roaming\Download\714052.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\714052.exe"C:\Users\Admin\AppData\Roaming\Download\714052.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\820300.exe"C:\Users\Admin\AppData\Roaming\Download\820300.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\820300.exe"C:\Users\Admin\AppData\Roaming\Download\820300.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\329014.exe"C:\Users\Admin\AppData\Roaming\Download\329014.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\329014.exe"C:\Users\Admin\AppData\Roaming\Download\329014.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\799728.exe"C:\Users\Admin\AppData\Roaming\Download\799728.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\799728.exe"C:\Users\Admin\AppData\Roaming\Download\799728.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\213267.exe"C:\Users\Admin\AppData\Roaming\Download\213267.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\213267.exe"C:\Users\Admin\AppData\Roaming\Download\213267.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\950320.exe"C:\Users\Admin\AppData\Roaming\Download\950320.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\950320.exe"C:\Users\Admin\AppData\Roaming\Download\950320.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\654839.exe"C:\Users\Admin\AppData\Roaming\Download\654839.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\654839.exe"C:\Users\Admin\AppData\Roaming\Download\654839.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\748196.exe"C:\Users\Admin\AppData\Roaming\Download\748196.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\748196.exe"C:\Users\Admin\AppData\Roaming\Download\748196.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\048818.exe"C:\Users\Admin\AppData\Roaming\Download\048818.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\048818.exe"C:\Users\Admin\AppData\Roaming\Download\048818.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\598697.exe"C:\Users\Admin\AppData\Roaming\Download\598697.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\598697.exe"C:\Users\Admin\AppData\Roaming\Download\598697.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\244758.exe"C:\Users\Admin\AppData\Roaming\Download\244758.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\244758.exe"C:\Users\Admin\AppData\Roaming\Download\244758.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\635662.exe"C:\Users\Admin\AppData\Roaming\Download\635662.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\635662.exe"C:\Users\Admin\AppData\Roaming\Download\635662.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\980545.exe"C:\Users\Admin\AppData\Roaming\Download\980545.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\980545.exe"C:\Users\Admin\AppData\Roaming\Download\980545.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\239444.exe"C:\Users\Admin\AppData\Roaming\Download\239444.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\239444.exe"C:\Users\Admin\AppData\Roaming\Download\239444.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\873788.exe"C:\Users\Admin\AppData\Roaming\Download\873788.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\873788.exe"C:\Users\Admin\AppData\Roaming\Download\873788.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\435584.exe"C:\Users\Admin\AppData\Roaming\Download\435584.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\435584.exe"C:\Users\Admin\AppData\Roaming\Download\435584.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\826196.exe"C:\Users\Admin\AppData\Roaming\Download\826196.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\826196.exe"C:\Users\Admin\AppData\Roaming\Download\826196.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\951178.exe"C:\Users\Admin\AppData\Roaming\Download\951178.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\951178.exe"C:\Users\Admin\AppData\Roaming\Download\951178.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\107151.exe"C:\Users\Admin\AppData\Roaming\Download\107151.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\107151.exe"C:\Users\Admin\AppData\Roaming\Download\107151.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\453244.exe"C:\Users\Admin\AppData\Roaming\Download\453244.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\453244.exe"C:\Users\Admin\AppData\Roaming\Download\453244.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ffd8136c188,0x7ffd8136c194,0x7ffd8136c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10841595940506453274,10309773217263062630,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,16938748835410926593,16594894752135079735,262144 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,4222484703038503980,3963463862960284096,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,4931953413709075284,8768440267325172271,2097152 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,17366754727486368087,13168721217310260970,2097152 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,2117322247400218666,9241512475059885245,2097152 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,15893229580234934823,3258609231164657697,2097152 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,6016822068121112384,1992595256844387418,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5400,i,15275074621367839174,4850396157656618047,2097152 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,952357336786800185,8256437773380372018,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,11586180719420228565,1296630831282003232,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10769547984110874140,9123746192385033831,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10769547984110874140,9123746192385033831,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,13976492453644693295,17282928563178230626,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,16365029533017429365,4697644442960470566,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,12995426645491256494,6318626918316517916,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,10584350880362870015,3982120968356139542,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3772,i,2920827115046171885,15424283139688959043,2097152 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14692662361853017314,8097000891391298273,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10805297387767927151,1606069730951021149,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7551047564743603420,4633204474721515701,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14890720463101982271,10796333039166044018,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,2817670616176576679,2759015874083330766,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,5405612474545378644,6974018301833049345,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,9212130077927668869,9654364935464345344,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,11022622929020887260,8614665442909201276,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=920,i,6728519585866716013,15781524259574523870,262144 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,15963702130793147135,17643126414238387560,524288 --field-trial-handle=1936,i,11628089957976802511,2436815898968842710,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
26542e48-dfc8-42bc-bb14-c1e1732bfac9.tmp
6f12eecb-1db7-4e49-9595-c8462ba70d94.tmp
85ddf68d-6506-495d-9449-fd377e45b75e.tmp
bc16c81e-9a55-49d5-9cc3-fdd81afbfe34.tmp
settings.dat
settings.dat
371f1e5a-faec-4e52-aeed-b613e19d6cff.tmp
3c9c1555-0792-4350-a8b0-935468f36fad.tmp
55c85577-c112-43bc-8175-6578af4131b9.tmp
91ae2e13-0eea-4bef-bce1-b8bb1eda206e.tmp
92931de8-01ad-49bf-9de9-d7b23a1c4275.tmp
LOG.old
f_00006d
96f9b4f9adf74a24_0
temp-index
the-real-index
1119164e-932f-4718-aa8d-9251c4cc8310.tmp
9215c991-c26b-460a-a561-5709d9ccf107.tmp
9a7c8b95-a8c8-416f-b879-683297d02cbb.tmp
a5042a68-4876-4655-a278-58a2028131be.tmp
e4b887ff-2c6a-410c-8a77-400eb94c7466.tmp
sync_diagnostic.log
d94ace5f-140f-4bd1-9bc8-2ab4e4036f3a.tmp
OperationConfig
b06b743e-ef18-45aa-9a30-632afdf09ac2.tmp
cb36d078-157c-48d9-ad59-8a12ff05e730.tmp
302e903b-e148-46b0-8b47-19feedcefbd0.tmp
87c205e1-d4f8-4a59-9598-40bb30db3398.tmp
aa1cfe3f-5f6c-49b1-bc9d-ee901a0808ec.tmp
08964af6-92f6-4d51-b067-10ff3fffbaff.tmp
hao.360[1].xml
sed_api_weather_info[1].htm
time[1].js
0[1].png
2[1].png
149ed942-11e8-40e2-a4f3-e9914ac2c93a.tmp
4fb51cf1-4849-4354-a3f5-4f4000c37051.tmp
ldsajdklsajdlkjsalkda.bat
content.js
swadfe.exe
062226.exe
070314.exe
373545.exe
431782.exe
461830.exe
600402.exe
622954.exe
656575.exe
821496.exe
826556.exe
875166.exe
882802.exe
987394.exe
manifest.json
manifest.json
manifest.json
manifest.json
memory/2756-19-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4404-217-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4856-111-0x000000000FCC0000-0x000000000FDC0000-memory.dmp
memory/5192-977-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1089-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1035-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1136-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-899-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1173-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-632-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1210-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-423-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1265-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-1294-0x0000000000400000-0x000000000059A000-memory.dmp
memory/5192-936-0x0000000000400000-0x000000000059A000-memory.dmp