184db49720fb3f401b5241c3c3b9e02767a928525e16c650a820d256e0618e15

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.5MB
Sample261020-kr8vaaxy7m
SHA256 184db49720fb3f401b5241c3c3b9e02767a928525e16c650a820d256e0618e15
MD5 194f64cf213d48e9688ad0cf3bebe0b4
SHA1 536b60ef4cfb411ae8d0a8cac5e95feb2d500054
SHA512 a87dfe894c2a883027c8cee2ba692ced0b4666a91f0adef5b12508c77806266034c62a9defa8f2086ac67c994af024b13c0ae60d2a4838ce3aa7c3360d2e5e74
SSDEEP 24576:S2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSBJlh9bD8R4e7J9:6dGXpiQSfjJi40yqi0Om
TLSH
T1C6C51930A6209125D8ABD1B58A6E617E601CEDD0930462CB51D87FFBFB75AF03D3099E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 4 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Executes dropped EXE 13 IoCs

pid	Process
3200	base.sfx.part01.exe
4456	base.exe
5168	svchost.exe
3652	base.exe
1672	7A97.tmp.exe
3800	svchost.exe
3240	base.exe
3180	svchost.exe
2060	base.exe
6428	7E60.tmp.exe
7060	snotes.exe
6624	snotes.exe
6424	snotes.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\l:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\o:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\i:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\q:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\h:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\s:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\w:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\d:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\u:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\y:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\n:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\x:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\m:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\p:	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\7E60.tmp.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part04.rar	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\7E60.tmp.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\inf\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part02.rar	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\base.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.exe	base.sfx.part01.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	base.sfx.part01.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\storage.dll	snotes.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\base.sfx.part01.exe	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part03.rar	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240744125	base.sfx.part01.exe
File opened for modification	C:\Windows\snotes.exe	base.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snotes.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A97.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4376	taskkill.exe
1956	taskkill.exe
3156	taskkill.exe
1976	taskkill.exe
4060	taskkill.exe
7436	taskkill.exe
5484	taskkill.exe
7076	taskkill.exe
6476	taskkill.exe
6484	taskkill.exe
2452	taskkill.exe
5780	taskkill.exe
3780	taskkill.exe
1844	taskkill.exe
948	taskkill.exe
5404	taskkill.exe
5928	taskkill.exe
3936	taskkill.exe
2124	taskkill.exe
3336	taskkill.exe
4652	taskkill.exe
6844	taskkill.exe
6548	taskkill.exe
5912	taskkill.exe
1780	taskkill.exe
4200	taskkill.exe
6308	taskkill.exe
3332	taskkill.exe
1800	taskkill.exe
1704	taskkill.exe
6932	taskkill.exe
2952	taskkill.exe
4584	taskkill.exe
1908	taskkill.exe
7068	taskkill.exe
3860	taskkill.exe
1372	taskkill.exe
6040	taskkill.exe
2080	taskkill.exe
6732	taskkill.exe
1248	taskkill.exe
1284	taskkill.exe
4192	taskkill.exe
7776	taskkill.exe
6044	taskkill.exe
3700	taskkill.exe
6716	taskkill.exe
6612	taskkill.exe
1368	taskkill.exe
6108	taskkill.exe
1292	taskkill.exe
4324	taskkill.exe
3692	taskkill.exe
620	taskkill.exe
704	taskkill.exe
3460	taskkill.exe
5020	taskkill.exe
5832	taskkill.exe
2956	taskkill.exe
4600	taskkill.exe
2612	taskkill.exe
4880	taskkill.exe
2276	taskkill.exe
8064	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	snotes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	snotes.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4456	base.exe
4456	base.exe
5168	svchost.exe
5168	svchost.exe
5168	svchost.exe
5168	svchost.exe
5168	svchost.exe
5168	svchost.exe
3652	base.exe
3652	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe
4456	base.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeShutdownPrivilege	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	704	taskkill.exe
Token: SeDebugPrivilege	5816	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	5404	taskkill.exe
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	5168	svchost.exe
Token: SeShutdownPrivilege	5168	svchost.exe
Token: SeDebugPrivilege	3800	svchost.exe
Token: SeShutdownPrivilege	3800	svchost.exe
Token: SeDebugPrivilege	3156	taskkill.exe
Token: SeDebugPrivilege	3780	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	5848	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	4060	taskkill.exe
Token: SeDebugPrivilege	3180	svchost.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeShutdownPrivilege	3180	svchost.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	1976	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	5284	taskkill.exe
Token: SeDebugPrivilege	4324	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	5776	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	6044	taskkill.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeDebugPrivilege	7060	snotes.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	6932	taskkill.exe
Token: SeDebugPrivilege	6844	taskkill.exe
Token: SeDebugPrivilege	7076	taskkill.exe
Token: SeDebugPrivilege	7068	taskkill.exe
Token: SeDebugPrivilege	6716	taskkill.exe
Token: SeDebugPrivilege	6704	taskkill.exe
Token: SeDebugPrivilege	6732	taskkill.exe
Token: SeDebugPrivilege	6612	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	6476	taskkill.exe
Token: SeDebugPrivilege	7148	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	6548	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	7A97.tmp.exe
6428	7E60.tmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 5484	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4416 wrote to memory of 2956	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4416 wrote to memory of 3200	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 4416 wrote to memory of 3332	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4416 wrote to memory of 3336	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	93
PID 4416 wrote to memory of 704	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 4416 wrote to memory of 620	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 4416 wrote to memory of 5404	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 4416 wrote to memory of 1908	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 4416 wrote to memory of 3448	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 4416 wrote to memory of 5816	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	99
PID 4416 wrote to memory of 5780	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	110
PID 4416 wrote to memory of 1948	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	111
PID 4416 wrote to memory of 5044	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	112
PID 4416 wrote to memory of 4464	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	113
PID 4416 wrote to memory of 4536	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	114
PID 4416 wrote to memory of 4604	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	115
PID 4416 wrote to memory of 4348	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	116
PID 4416 wrote to memory of 928	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	117
PID 4416 wrote to memory of 1912	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	118
PID 4416 wrote to memory of 452	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	119
PID 4416 wrote to memory of 4456	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	131
PID 4416 wrote to memory of 5168	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	133
PID 5168 wrote to memory of 3652	5168	svchost.exe	134
PID 5168 wrote to memory of 5848	5168	svchost.exe	135
PID 5168 wrote to memory of 4652	5168	svchost.exe	136
PID 5168 wrote to memory of 4060	5168	svchost.exe	137
PID 5168 wrote to memory of 1704	5168	svchost.exe	138
PID 5168 wrote to memory of 1976	5168	svchost.exe	139
PID 5168 wrote to memory of 2124	5168	svchost.exe	140
PID 5168 wrote to memory of 2612	5168	svchost.exe	141
PID 5168 wrote to memory of 3156	5168	svchost.exe	142
PID 5168 wrote to memory of 3780	5168	svchost.exe	143
PID 5168 wrote to memory of 1956	5168	svchost.exe	144
PID 5168 wrote to memory of 1076	5168	svchost.exe	145
PID 5168 wrote to memory of 1108	5168	svchost.exe	146
PID 5168 wrote to memory of 4544	5168	svchost.exe	147
PID 5168 wrote to memory of 2744	5168	svchost.exe	148
PID 5168 wrote to memory of 2480	5168	svchost.exe	149
PID 5168 wrote to memory of 5984	5168	svchost.exe	150
PID 5168 wrote to memory of 1940	5168	svchost.exe	151
PID 5168 wrote to memory of 1060	5168	svchost.exe	152
PID 5168 wrote to memory of 5448	5168	svchost.exe	153
PID 5168 wrote to memory of 1300	5168	svchost.exe	154
PID 4416 wrote to memory of 1672	4416	2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	176
PID 3800 wrote to memory of 3240	3800	svchost.exe	177
PID 3800 wrote to memory of 3180	3800	svchost.exe	178
PID 3800 wrote to memory of 1292	3800	svchost.exe	179
PID 3800 wrote to memory of 4600	3800	svchost.exe	180
PID 3800 wrote to memory of 3692	3800	svchost.exe	181
PID 3800 wrote to memory of 948	3800	svchost.exe	182
PID 3800 wrote to memory of 5776	3800	svchost.exe	183
PID 3800 wrote to memory of 6044	3800	svchost.exe	184
PID 3800 wrote to memory of 1800	3800	svchost.exe	185
PID 3800 wrote to memory of 4324	3800	svchost.exe	186
PID 3800 wrote to memory of 5284	3800	svchost.exe	187
PID 3800 wrote to memory of 4376	3800	svchost.exe	188
PID 3800 wrote to memory of 1140	3800	svchost.exe	189
PID 3800 wrote to memory of 5752	3800	svchost.exe	190
PID 3800 wrote to memory of 1736	3800	svchost.exe	191
PID 3800 wrote to memory of 5544	3800	svchost.exe	192
PID 3800 wrote to memory of 5892	3800	svchost.exe	193
PID 3800 wrote to memory of 2008	3800	svchost.exe	194
PID 3800 wrote to memory of 2632	3800	svchost.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_194f64cf213d48e9688ad0cf3bebe0b4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\base.sfx.part01.exe
  "C:\\Windows\\base.sfx.part01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3200
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5484
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:5780
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:1948
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:4464
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:4536
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4604
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:4348
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:928
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:1912
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:452
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1076
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2744
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6612
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6540
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:7064
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6592
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6628
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6472
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:7088
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6600
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:6040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    PID:1780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:4192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:5020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:3700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:4584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4200
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4232
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:7972
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:556
- C:\Users\Admin\AppData\Local\Temp\7A97.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\7A97.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1672

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3240
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6624
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:2060
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:7060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:6148
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6156
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6172
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6180
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    PID:6636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:3860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6484
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6516
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7108
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7016
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:6200
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5604
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:6664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:6108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:5832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:8064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:6308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6140
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:7480
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:7768
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:7500
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:7264
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:7404
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:1140
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:5752
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:1736
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:5544
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5892
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:2008
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:2632
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:956
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1048
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- C:\Windows\7E60.tmp.exe
  "C:\Windows\7E60.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6428

C:\Windows\snotes.exe
C:\Windows\snotes.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

authorize[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MJOBZ9FO\authorize[1].htm
Size 49KB
SHA256 ef68dbdaceb831e73034edf5c81cd4694ab6ecc935c94368b1fc7e7a101c6a1b
MD5 4e48615e10a84a500edde28baa242d68
SHA1 4bd7e7224ea22c73c8584570b158539b34933624
SHA512 2f4afaa718dcd4961793512afbc82ffcb8ee16f02759fed096b203d43b3310c08a9a215b759931a486f66e33743f5d81b1016dd6584c3d4b5e1313884219cfe7
SSDEEP 1536:nC8GLG2pm9ZQv0P2daZcGn4fVZbaDH4CB/Z9Tjuokmap5vPoz+uDj+:C84YZQv0PnZc44fVZb3C1a/Am
TLSH
T147338EEA7F84382BCB935575C49F7B06EA790953584CC8D5F08D888D1EFABDA0627603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7A97.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\7A97.tmp.exe
Size 20KB
SHA256 f4dca24e2c1e63a418436d61f969424854df72de25e608eec255e6303fa38653
MD5 1d557016c8a9f405ce9176889662cb95
SHA1 281bc8a501bbd929aee12221b348c5f595d8892b
SHA512 b3a723324f7900dbd771d725430ad92361b4cd60af4cd1fa6a54218c4983aa0d24f1bd5e5fcd343650e8c16b50afd067c6a7ed265353c9ef98e9ea1ed78aa094
SSDEEP 96:Vr2+jXg4tbek3l5naDTQnkbFK1NpbTzz13ndf7FYWt2GlibDz2:PXg4tbek3l5nGcnKYtj2Lz
TLSH
T13E927361E92C18B1F65A47330E3787FE121BBC241E019F8B78897F6D1C316816CB1A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.5MB
SHA256 d117a0f8b88ccf72a32411aa9492cba52b3704d394dddabc4cbbe5698cafa522
MD5 b5d0962359538393f4d47dd3ca9262ad
SHA1 d775eca359d1faf195fc6e64e59c3d67123201bf
SHA512 b96c3e4d00f991f2ae4159db984954adc0e5a337169bfc103ec1c573b8ed4a88cddd8589356384b4ce89c71d05e6285a75c3e34fa00623b0d632f09c5d4c63f3
SSDEEP 24576:S2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSBJlh9bD8R4e7Jq:6dGXpiQSfjJi40yqi0OB
TLSH
T1B4C51930A6209125D8ABD1B58A6E617E601CEDD0930462CB51D87FFBFB75AF03D3099E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\IME\svchost.exe
Size 2.5MB
SHA256 184db49720fb3f401b5241c3c3b9e02767a928525e16c650a820d256e0618e15
MD5 194f64cf213d48e9688ad0cf3bebe0b4
SHA1 536b60ef4cfb411ae8d0a8cac5e95feb2d500054
SHA512 a87dfe894c2a883027c8cee2ba692ced0b4666a91f0adef5b12508c77806266034c62a9defa8f2086ac67c994af024b13c0ae60d2a4838ce3aa7c3360d2e5e74
SSDEEP 24576:S2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSBJlh9bD8R4e7J9:6dGXpiQSfjJi40yqi0Om
TLSH
T1C6C51930A6209125D8ABD1B58A6E617E601CEDD0930462CB51D87FFBFB75AF03D3099E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.exe

Path C:\Windows\base.exe
Size 115KB
SHA256 e79865cb9fc8e0e264163c2a96479f96e732ba1e9e22cc1c562761ab0c34d41b
MD5 55979fd18ae7b8562dfe77819bb97fb2
SHA1 0f9b914ddf18abc43002ec0b5ae912d72293b294
SHA512 ab8bc73fd7e9167d02c91594f398028e5089c21f27377e02f81c8d4e80d56113f1026523c1101a82e0e76b51d328ef9f09e7b4aaa5aa780286045e9dfa826b25
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T152C3F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part01.exe

Path C:\Windows\base.sfx.part01.exe
Size 253KB
SHA256 c52b503f6669c833820c92d66dfc3fb0a8781dbf9b9065e42b5d08696932ae93
MD5 f294b8ca88754b1e2cdc02d8765b7d0e
SHA1 64620bf981a8876563aa249a1a67c41e9e75b2d7
SHA512 0f8bc0f21886f7568e01d22eb9d3a4e72893f48ef9bd2bac984ceadeb1792fea9ba2a10d2115eae68b8fa4e856dc15fb80fa37626bcfda42036e2dae99918835
SSDEEP 6144:Mc0h522p3l04ZMSmIp3Uy28uhyOtF5R3:ahxp3lZnT9bD8R3
TLSH
T1FA44BF12BAC2C8B3D53218355929EB15A97C79200F69DE9FA7D40D3EEE301D06625FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part02.rar

Path C:\Windows\base.sfx.part02.rar
Size 10KB
SHA256 216bdad3ee7908ab436d4c921f93adf52ad73be7be186da66d96bfcf89bd24d9
MD5 a30552e931d79d550df1c8f9fce7fa79
SHA1 3a8a5ceadd2c6ab7a0c565223937de74750fe934
SHA512 ae096afbdfed88b6c17361ad1313ac996ff840b2289de4b6572e35dac8a8af7d6b006f2f76a37a28a225a03ec890119edd51c96705b9cf0fd35da34c927ba0cb
SSDEEP 192:uSEQ1ZSf7O11NCBvUaNCMRu2CCLg/3xVhffdsGyCeXcDU4hSHn68mDTWeUXI9MAL:B/1ZN11kFU1MsiLg/BvZ7IcDaHnDSWdD
TLSH
T11D22CFC4985D63F9D37B0235A822D38D7D34E583321E5832B4D98C279D518A89EC4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part03.rar

Path C:\Windows\base.sfx.part03.rar
Size 10KB
SHA256 9e2bae5cb3c26a38f38a4364cdf708121e4aaa2f5519e67f6287e4dfa311a9bf
MD5 7bf0b2c4a28ceb748c7406556a61b698
SHA1 ed6704a932053909c6eaf27b134644cf449d3fad
SHA512 a36aa329b091804a6b4af8c56fd32fb7618aafa0e133753972d4f17a940e006e698750a10ac4423ef8cd3746202a0e17b99876f5b503a9c1edaad1e10e361702
SSDEEP 192:WSHqKYN/gKVMesSovtAkNAnJUFmyU+CyqSHhAUlh+YnJ6KvLusrnqSMb:hrMrVwSWtAtJqmcES+qcYJ6KTuszrM
TLSH
T18722C03B2098758BC5912A7198CF547B5401E9FABE317B96022B9E13BAA1291D1FF1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part04.rar

Path C:\Windows\base.sfx.part04.rar
Size 9KB
SHA256 603942cfbd2c60faa571b4fc939c334636484d9c3825910252f7b9a503a4b020
MD5 d3a9c4f54c9d223227a5f19f80061c1b
SHA1 4a36584282dcb34201ff47f5c1ae291ad381a4e6
SHA512 c45ab824955a2c2efd67fa1c0b09bf4c233fe41d7f5dd2aaca584e742fc2be18b37f650f88b1b70ab2b4de8a35eebaf79a624c470d475277902dace10af1c018
SSDEEP 192:ttzpJJUdDREaz0lpH8DJw7EhzE+EH2Q1HfVkztVSihKRGgCp+qB8BdL1zZ/:npJKdDRSlNUf4RNfVOhiG5Qqav1zZ/
TLSH
T19712AF40656F5F2285BB3220EEACB390C72505BDC9DA6C2DE83976943311DDEE460765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 96.0MB
SHA256 8510a80b70c3ac9f9edd782d0842cba2d9085a5644595e9be41cf16681f9f3a7
MD5 9145b597bc6e82b99f1a9e52be97febd
SHA1 c9828745db6dae548db4e9be009e62cea724330f
SHA512 0bf422032363f16dba27cde7f7e441f8e136cda7d4e483f566d6f74d82d69649215aeffb33925a5bdf4f88c9f98ddd0105c3859489a3188dd43c5c21780ad35f
SSDEEP 98304:3AJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJE:p
TLSH
T1F928F144A31E78E0C28067F4734B9CC96026FEBD3BE489A92DAC9D156DD40D93179EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 3.6MB
SHA256 5e416c0f969b47190686023372be5f3921e4d9a493de28df7f10d362351b0536
MD5 235f2230be58ea4ad1c614a6e3066293
SHA1 04c8044e86e902fb2753c81408fc342abc8f3dce
SHA512 fb344b66441f1d70c025f2d6a3cba32efc1806b219a5d0519d3d4933cddf817c93dfb6339af9734474bd0d4404f7762c0546d8dd34ed76501bcf026dbbd6229b
SSDEEP 6144:MGOmtyKApF+OelHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHS:MGoB
TLSH
T154068D7A002A7C84E09648B0261C08D221B5E4D77B7D5DBBA96F65C6ECFF5CC80BD74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 96.0MB
SHA256 fc1c5a406aecac842a0ef04a60f38a5ea428a514c92901d154ea54f2189e6ec1
MD5 e25af376a12268cb1841ee5fb31e1de3
SHA1 edc7fa82f9191b76a7dd635a93a424499afbc097
SHA512 0f597b0367ebe13b0b9c21b9420acdbcf37aa81e023669498ef5244977037089ceea0847ad2662380243d6f8cc61b7b78e4e2a4e8e2bec7106e489db4d4092da
SSDEEP 98304:3VJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJE:o
TLSH
T16228F144635E7CE0C2816BF4B34B9CC86025FABD3BE489692DAC9E156CD40D93179EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 96.0MB
SHA256 12da84e12bd7841a85390efe359e3a7516dbf0925b42ea10da3612a31aa2ab97
MD5 aea0366a3b480b4fdac1e46528c86745
SHA1 44c32b706b45925be2ec68a1fb435ffe864be73f
SHA512 b83a625d866b8dc6989a5ca8c147f83c2d5baf4df7c4dec123941861e27b2219317a60e2ea8bf23de4bf585146bcbf0209a907b1355a34733f207fed6718e55a
SSDEEP 98304:3yJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJE:b
TLSH
T11A28F144635E7CE0C28167F4B34B9CC86026FABD3BE489692DAC9E156CD40D93179EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-68-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3180-67-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/3240-66-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3652-63-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3800-65-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/3800-34-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/3800-69-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/4416-52-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/4416-64-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/4416-0-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/4416-1-0x0000000000676000-0x0000000000678000-memory.dmp

Download

memory/4456-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4456-19-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5168-62-0x0000000000400000-0x0000000000734000-memory.dmp

Download

memory/6424-74-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6624-73-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/7060-75-0x0000000000400000-0x0000000000431000-memory.dmp

Download