184db49720fb3f401b5241c3c3b9e02767a928525e16c650a820d256e0618e15

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.5MB
Sample261020-kr8vaaxy7m
SHA256 184db49720fb3f401b5241c3c3b9e02767a928525e16c650a820d256e0618e15
MD5 194f64cf213d48e9688ad0cf3bebe0b4
SHA1 536b60ef4cfb411ae8d0a8cac5e95feb2d500054
SHA512 a87dfe894c2a883027c8cee2ba692ced0b4666a91f0adef5b12508c77806266034c62a9defa8f2086ac67c994af024b13c0ae60d2a4838ce3aa7c3360d2e5e74
SSDEEP 24576:S2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSBJlh9bD8R4e7J9:6dGXpiQSfjJi40yqi0Om
TLSH
T1C6C51930A6209125D8ABD1B58A6E617E601CEDD0930462CB51D87FFBFB75AF03D3099E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	base.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	base.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	base.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	base.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 15 IoCs

pid	Process
4232	base.sfx.part01.exe
4260	base.exe
804	svchost.exe
2540	D9F2.tmp.exe
944	base.exe
5492	svchost.exe
5532	base.exe
5556	svchost.exe
5572	E4B0.tmp.exe
5800	base.exe
2124	snotes.exe
5144	snotes.exe
5152	snotes.exe
5276	snotes.exe
6720	snotes.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\e:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\w:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\i:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\u:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\h:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\x:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\e:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\j:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\t:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\e:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\p:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\z:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\m:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\o:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\e:	svchost.exe
File opened (read-only)	\??\v:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\E4B0.tmp.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\E4B0.tmp.exe	svchost.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\inf\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	base.sfx.part01.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\base.sfx.part01.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part02.rar	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.exe	base.sfx.part01.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\storage.dll	snotes.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part03.rar	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\base.sfx.part04.rar	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240703750	base.sfx.part01.exe
File opened for modification	C:\Windows\snotes.exe	base.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snotes.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4B0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4680	taskkill.exe
3524	taskkill.exe
6068	taskkill.exe
6752	taskkill.exe
6912	taskkill.exe
3320	taskkill.exe
5640	taskkill.exe
4712	taskkill.exe
2484	taskkill.exe
4540	taskkill.exe
6352	taskkill.exe
6880	taskkill.exe
4916	taskkill.exe
1064	taskkill.exe
3632	taskkill.exe
6052	taskkill.exe
6044	taskkill.exe
6012	taskkill.exe
5624	taskkill.exe
4128	taskkill.exe
212	taskkill.exe
6180	taskkill.exe
7152	taskkill.exe
3272	taskkill.exe
2256	taskkill.exe
6360	taskkill.exe
6212	taskkill.exe
1608	taskkill.exe
3812	taskkill.exe
4776	taskkill.exe
5540	taskkill.exe
2144	taskkill.exe
1812	taskkill.exe
5676	taskkill.exe
2732	taskkill.exe
1956	taskkill.exe
6888	taskkill.exe
2064	taskkill.exe
6060	taskkill.exe
5656	taskkill.exe
5648	taskkill.exe
4188	taskkill.exe
3424	taskkill.exe
3804	taskkill.exe
4052	taskkill.exe
2748	taskkill.exe
4928	taskkill.exe
6396	taskkill.exe
6172	taskkill.exe
3472	taskkill.exe
2316	taskkill.exe
640	taskkill.exe
6036	taskkill.exe
5664	taskkill.exe
5852	taskkill.exe
5076	taskkill.exe
6020	taskkill.exe
2372	taskkill.exe
6252	taskkill.exe
5476	taskkill.exe
6664	taskkill.exe
6336	taskkill.exe
5632	taskkill.exe
308	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	snotes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	snotes.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
804	svchost.exe
804	svchost.exe
4260	base.exe
4260	base.exe
804	svchost.exe
804	svchost.exe
804	svchost.exe
804	svchost.exe
944	base.exe
944	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe
4260	base.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeShutdownPrivilege	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	3320	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	804	svchost.exe
Token: SeShutdownPrivilege	804	svchost.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	1992	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	5492	svchost.exe
Token: SeShutdownPrivilege	5492	svchost.exe
Token: SeDebugPrivilege	5556	svchost.exe
Token: SeShutdownPrivilege	5556	svchost.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	5616	taskkill.exe
Token: SeDebugPrivilege	5640	taskkill.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	5600	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	5676	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	5656	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	6076	taskkill.exe
Token: SeDebugPrivilege	6044	taskkill.exe
Token: SeDebugPrivilege	6012	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	6036	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	6052	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	2124	snotes.exe
Token: SeDebugPrivilege	7152	taskkill.exe
Token: SeDebugPrivilege	6172	taskkill.exe
Token: SeDebugPrivilege	6180	taskkill.exe
Token: SeDebugPrivilege	6396	taskkill.exe
Token: SeDebugPrivilege	6664	taskkill.exe
Token: SeDebugPrivilege	5768	taskkill.exe
Token: SeDebugPrivilege	212	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	5852	taskkill.exe
Token: SeDebugPrivilege	6360	taskkill.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeDebugPrivilege	6212	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	D9F2.tmp.exe
5572	E4B0.tmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4232	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 4484 wrote to memory of 3524	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 4484 wrote to memory of 4680	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4484 wrote to memory of 2256	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4484 wrote to memory of 3272	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4484 wrote to memory of 1812	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	93
PID 4484 wrote to memory of 640	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 4484 wrote to memory of 3320	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 4484 wrote to memory of 5076	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 4484 wrote to memory of 2748	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 4484 wrote to memory of 2144	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 4484 wrote to memory of 2500	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 4484 wrote to memory of 4528	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 4484 wrote to memory of 4960	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	102
PID 4484 wrote to memory of 1224	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	103
PID 4484 wrote to memory of 3988	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	104
PID 4484 wrote to memory of 3604	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	105
PID 4484 wrote to memory of 884	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	106
PID 4484 wrote to memory of 3276	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	107
PID 4484 wrote to memory of 4000	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	108
PID 4484 wrote to memory of 4352	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	109
PID 4484 wrote to memory of 4260	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	129
PID 4484 wrote to memory of 804	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	130
PID 4484 wrote to memory of 2540	4484	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	131
PID 804 wrote to memory of 944	804	svchost.exe	132
PID 804 wrote to memory of 2732	804	svchost.exe	133
PID 804 wrote to memory of 4540	804	svchost.exe	134
PID 804 wrote to memory of 1992	804	svchost.exe	135
PID 804 wrote to memory of 2484	804	svchost.exe	136
PID 804 wrote to memory of 3056	804	svchost.exe	137
PID 804 wrote to memory of 4128	804	svchost.exe	138
PID 804 wrote to memory of 4928	804	svchost.exe	139
PID 804 wrote to memory of 1904	804	svchost.exe	140
PID 804 wrote to memory of 4712	804	svchost.exe	141
PID 804 wrote to memory of 4916	804	svchost.exe	142
PID 804 wrote to memory of 636	804	svchost.exe	143
PID 804 wrote to memory of 3980	804	svchost.exe	144
PID 804 wrote to memory of 3520	804	svchost.exe	145
PID 804 wrote to memory of 932	804	svchost.exe	146
PID 804 wrote to memory of 2264	804	svchost.exe	147
PID 804 wrote to memory of 1492	804	svchost.exe	148
PID 804 wrote to memory of 3748	804	svchost.exe	149
PID 804 wrote to memory of 3584	804	svchost.exe	150
PID 804 wrote to memory of 1736	804	svchost.exe	151
PID 804 wrote to memory of 2788	804	svchost.exe	152
PID 5492 wrote to memory of 5532	5492	svchost.exe	176
PID 5492 wrote to memory of 5556	5492	svchost.exe	177
PID 5492 wrote to memory of 5572	5492	svchost.exe	178
PID 5492 wrote to memory of 5600	5492	svchost.exe	179
PID 5492 wrote to memory of 5608	5492	svchost.exe	180
PID 5492 wrote to memory of 5616	5492	svchost.exe	181
PID 5492 wrote to memory of 5624	5492	svchost.exe	182
PID 5492 wrote to memory of 5632	5492	svchost.exe	183
PID 5492 wrote to memory of 5640	5492	svchost.exe	184
PID 5492 wrote to memory of 5648	5492	svchost.exe	185
PID 5492 wrote to memory of 5656	5492	svchost.exe	186
PID 5492 wrote to memory of 5664	5492	svchost.exe	187
PID 5492 wrote to memory of 5676	5492	svchost.exe	188
PID 5492 wrote to memory of 5684	5492	svchost.exe	189
PID 5492 wrote to memory of 5692	5492	svchost.exe	190
PID 5492 wrote to memory of 5700	5492	svchost.exe	191
PID 5492 wrote to memory of 5712	5492	svchost.exe	192
PID 5492 wrote to memory of 5720	5492	svchost.exe	193
PID 5492 wrote to memory of 5728	5492	svchost.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\base.sfx.part01.exe
  "C:\\Windows\\base.sfx.part01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4232
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:4528
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:4960
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:1224
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:3988
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:3604
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:884
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3276
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:4000
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    PID:5144
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:944
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:636
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3980
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:932
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2264
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3748
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7152
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:7160
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4892
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6296
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1456
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:204
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6968
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:3812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:3424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:4052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:6252
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:220
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:3864
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:728
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:976
- C:\Users\Admin\AppData\Local\Temp\D9F2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\D9F2.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2540

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  PID:5532
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5556
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5800
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      PID:5152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:6128
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:6352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:4188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:1956
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6464
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5504
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:5436
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5420
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:5476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:6880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:6752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:5540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:2316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:6912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6888
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:6240
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4760
- C:\Windows\SysWOW64\E4B0.tmp.exe
  "C:\Windows\system32\E4B0.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5572
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5616
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5632
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5656
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5676
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5684
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:5692
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:5700
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5712
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:5720
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:5728
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:5736
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:5744
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:5752
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:5760

C:\Windows\snotes.exe
C:\Windows\snotes.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

authorize[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8J9OU7H5\authorize[1].htm
Size 49KB
SHA256 bdef055d79cccb0d3214742b09d850131f6804b950ab47e91c248ca179d34d46
MD5 fe1f9ac6c3e329d8b4f5525af406267a
SHA1 57baed1d4d106e7678f403d243d6cf483c674f46
SHA512 9dd93b1383f2641adbde3abb22a072665f711c646ba4a84b22936f574e7f99679f004ba0b00a2fc6ab902f0c98e32c2e308e9604be714f0806770d24049962fa
SSDEEP 1536:tmjX8d8GLG2PxZuZ3YJxZKxAxBFvZxx8O0bBVZ9Tjuokmap5vPoz0uFzo:8XU8ixZuZ3YvZKxAxBFvZxxWbba/A0
TLSH
T1E2337DAABF54342BCB966A75C4BF7B06E97D08435888CCD4F08D88491EFAFD64167603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D9F2.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\D9F2.tmp.exe
Size 20KB
SHA256 f4dca24e2c1e63a418436d61f969424854df72de25e608eec255e6303fa38653
MD5 1d557016c8a9f405ce9176889662cb95
SHA1 281bc8a501bbd929aee12221b348c5f595d8892b
SHA512 b3a723324f7900dbd771d725430ad92361b4cd60af4cd1fa6a54218c4983aa0d24f1bd5e5fcd343650e8c16b50afd067c6a7ed265353c9ef98e9ea1ed78aa094
SSDEEP 96:Vr2+jXg4tbek3l5naDTQnkbFK1NpbTzz13ndf7FYWt2GlibDz2:PXg4tbek3l5nGcnKYtj2Lz
TLSH
T13E927361E92C18B1F65A47330E3787FE121BBC241E019F8B78897F6D1C316816CB1A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.5MB
SHA256 d117a0f8b88ccf72a32411aa9492cba52b3704d394dddabc4cbbe5698cafa522
MD5 b5d0962359538393f4d47dd3ca9262ad
SHA1 d775eca359d1faf195fc6e64e59c3d67123201bf
SHA512 b96c3e4d00f991f2ae4159db984954adc0e5a337169bfc103ec1c573b8ed4a88cddd8589356384b4ce89c71d05e6285a75c3e34fa00623b0d632f09c5d4c63f3
SSDEEP 24576:S2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSBJlh9bD8R4e7Jq:6dGXpiQSfjJi40yqi0OB
TLSH
T1B4C51930A6209125D8ABD1B58A6E617E601CEDD0930462CB51D87FFBFB75AF03D3099E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\INF\svchost.exe
Size 2.5MB
SHA256 184db49720fb3f401b5241c3c3b9e02767a928525e16c650a820d256e0618e15
MD5 194f64cf213d48e9688ad0cf3bebe0b4
SHA1 536b60ef4cfb411ae8d0a8cac5e95feb2d500054
SHA512 a87dfe894c2a883027c8cee2ba692ced0b4666a91f0adef5b12508c77806266034c62a9defa8f2086ac67c994af024b13c0ae60d2a4838ce3aa7c3360d2e5e74
SSDEEP 24576:S2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSBJlh9bD8R4e7J9:6dGXpiQSfjJi40yqi0Om
TLSH
T1C6C51930A6209125D8ABD1B58A6E617E601CEDD0930462CB51D87FFBFB75AF03D3099E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.exe

Path C:\Windows\base.exe
Size 115KB
SHA256 e79865cb9fc8e0e264163c2a96479f96e732ba1e9e22cc1c562761ab0c34d41b
MD5 55979fd18ae7b8562dfe77819bb97fb2
SHA1 0f9b914ddf18abc43002ec0b5ae912d72293b294
SHA512 ab8bc73fd7e9167d02c91594f398028e5089c21f27377e02f81c8d4e80d56113f1026523c1101a82e0e76b51d328ef9f09e7b4aaa5aa780286045e9dfa826b25
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T152C3F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part01.exe

Path C:\Windows\base.sfx.part01.exe
Size 253KB
SHA256 c52b503f6669c833820c92d66dfc3fb0a8781dbf9b9065e42b5d08696932ae93
MD5 f294b8ca88754b1e2cdc02d8765b7d0e
SHA1 64620bf981a8876563aa249a1a67c41e9e75b2d7
SHA512 0f8bc0f21886f7568e01d22eb9d3a4e72893f48ef9bd2bac984ceadeb1792fea9ba2a10d2115eae68b8fa4e856dc15fb80fa37626bcfda42036e2dae99918835
SSDEEP 6144:Mc0h522p3l04ZMSmIp3Uy28uhyOtF5R3:ahxp3lZnT9bD8R3
TLSH
T1FA44BF12BAC2C8B3D53218355929EB15A97C79200F69DE9FA7D40D3EEE301D06625FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part02.rar

Path C:\Windows\base.sfx.part02.rar
Size 10KB
SHA256 216bdad3ee7908ab436d4c921f93adf52ad73be7be186da66d96bfcf89bd24d9
MD5 a30552e931d79d550df1c8f9fce7fa79
SHA1 3a8a5ceadd2c6ab7a0c565223937de74750fe934
SHA512 ae096afbdfed88b6c17361ad1313ac996ff840b2289de4b6572e35dac8a8af7d6b006f2f76a37a28a225a03ec890119edd51c96705b9cf0fd35da34c927ba0cb
SSDEEP 192:uSEQ1ZSf7O11NCBvUaNCMRu2CCLg/3xVhffdsGyCeXcDU4hSHn68mDTWeUXI9MAL:B/1ZN11kFU1MsiLg/BvZ7IcDaHnDSWdD
TLSH
T11D22CFC4985D63F9D37B0235A822D38D7D34E583321E5832B4D98C279D518A89EC4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part03.rar

Path C:\Windows\base.sfx.part03.rar
Size 10KB
SHA256 9e2bae5cb3c26a38f38a4364cdf708121e4aaa2f5519e67f6287e4dfa311a9bf
MD5 7bf0b2c4a28ceb748c7406556a61b698
SHA1 ed6704a932053909c6eaf27b134644cf449d3fad
SHA512 a36aa329b091804a6b4af8c56fd32fb7618aafa0e133753972d4f17a940e006e698750a10ac4423ef8cd3746202a0e17b99876f5b503a9c1edaad1e10e361702
SSDEEP 192:WSHqKYN/gKVMesSovtAkNAnJUFmyU+CyqSHhAUlh+YnJ6KvLusrnqSMb:hrMrVwSWtAtJqmcES+qcYJ6KTuszrM
TLSH
T18722C03B2098758BC5912A7198CF547B5401E9FABE317B96022B9E13BAA1291D1FF1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part04.rar

Path C:\Windows\base.sfx.part04.rar
Size 9KB
SHA256 603942cfbd2c60faa571b4fc939c334636484d9c3825910252f7b9a503a4b020
MD5 d3a9c4f54c9d223227a5f19f80061c1b
SHA1 4a36584282dcb34201ff47f5c1ae291ad381a4e6
SHA512 c45ab824955a2c2efd67fa1c0b09bf4c233fe41d7f5dd2aaca584e742fc2be18b37f650f88b1b70ab2b4de8a35eebaf79a624c470d475277902dace10af1c018
SSDEEP 192:ttzpJJUdDREaz0lpH8DJw7EhzE+EH2Q1HfVkztVSihKRGgCp+qB8BdL1zZ/:npJKdDRSlNUf4RNfVOhiG5Qqav1zZ/
TLSH
T19712AF40656F5F2285BB3220EEACB390C72505BDC9DA6C2DE83976943311DDEE460765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 50.1MB
SHA256 9bd6f4a797d6b068c67fa9e8f08efd7540f296fb783f989033c224e090c09276
MD5 606e73c8dfb61b814b245cd43d029d6d
SHA1 30246168b536f84480ae87ae32bdeab04cda0a58
SHA512 4417b9be041b2086c5fa0160a9b71eb6f5f4280960e7fe1c34bde363fee6ce4f8088306e1587b040b1a5b04b7fc22f26424fcfa3453609dc74c91b7c4899fbec
SSDEEP 98304:3yJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJc:j
TLSH
T124B70244635E7CE4C28027C4B34B9CC8B075FABD3BD889796D6C9A126D980DD3578EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/804-40-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/804-83-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/944-44-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/944-84-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2124-103-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2124-92-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4260-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4260-82-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4484-89-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/4484-1-0x0000000000676000-0x0000000000678000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/4484-74-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/5144-97-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5144-96-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5152-99-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5276-98-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5492-85-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/5492-90-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/5492-60-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/5532-86-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5532-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5556-87-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/5556-70-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/5800-88-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5800-75-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6720-101-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6720-102-0x0000000000400000-0x0000000000431000-memory.dmp

Download