Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 13:00
General
- Target 2026-10-19_90e489926b93bb6b7d64da39f3853dc0_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261020-p8s8daes2q
- SHA256 045018b3ce8025b5e34f7f39415eab63b26deedfeb0eb04d449dab96c2dc90ee
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 44 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_90e489926b93bb6b7d64da39f3853dc0_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_90e489926b93bb6b7d64da39f3853dc0_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\yuczjc.exe"C:\Users\Admin\AppData\Local\Temp\yuczjc.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yuczjc.exe"C:\Users\Admin\AppData\Local\Temp\yuczjc.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\458500.exe"C:\Users\Admin\AppData\Roaming\Download\458500.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\458500.exe"C:\Users\Admin\AppData\Roaming\Download\458500.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\564020.exe"C:\Users\Admin\AppData\Roaming\Download\564020.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\564020.exe"C:\Users\Admin\AppData\Roaming\Download\564020.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\107246.exe"C:\Users\Admin\AppData\Roaming\Download\107246.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\107246.exe"C:\Users\Admin\AppData\Roaming\Download\107246.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\147523.exe"C:\Users\Admin\AppData\Roaming\Download\147523.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\147523.exe"C:\Users\Admin\AppData\Roaming\Download\147523.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\297400.exe"C:\Users\Admin\AppData\Roaming\Download\297400.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\297400.exe"C:\Users\Admin\AppData\Roaming\Download\297400.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\345662.exe"C:\Users\Admin\AppData\Roaming\Download\345662.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\345662.exe"C:\Users\Admin\AppData\Roaming\Download\345662.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\571645.exe"C:\Users\Admin\AppData\Roaming\Download\571645.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\571645.exe"C:\Users\Admin\AppData\Roaming\Download\571645.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\069257.exe"C:\Users\Admin\AppData\Roaming\Download\069257.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\069257.exe"C:\Users\Admin\AppData\Roaming\Download\069257.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\215430.exe"C:\Users\Admin\AppData\Roaming\Download\215430.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\215430.exe"C:\Users\Admin\AppData\Roaming\Download\215430.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\964502.exe"C:\Users\Admin\AppData\Roaming\Download\964502.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\964502.exe"C:\Users\Admin\AppData\Roaming\Download\964502.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\933469.exe"C:\Users\Admin\AppData\Roaming\Download\933469.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\933469.exe"C:\Users\Admin\AppData\Roaming\Download\933469.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\376173.exe"C:\Users\Admin\AppData\Roaming\Download\376173.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\376173.exe"C:\Users\Admin\AppData\Roaming\Download\376173.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\091509.exe"C:\Users\Admin\AppData\Roaming\Download\091509.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\091509.exe"C:\Users\Admin\AppData\Roaming\Download\091509.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\636955.exe"C:\Users\Admin\AppData\Roaming\Download\636955.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\636955.exe"C:\Users\Admin\AppData\Roaming\Download\636955.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\962837.exe"C:\Users\Admin\AppData\Roaming\Download\962837.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\962837.exe"C:\Users\Admin\AppData\Roaming\Download\962837.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\597363.exe"C:\Users\Admin\AppData\Roaming\Download\597363.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\597363.exe"C:\Users\Admin\AppData\Roaming\Download\597363.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\988977.exe"C:\Users\Admin\AppData\Roaming\Download\988977.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\988977.exe"C:\Users\Admin\AppData\Roaming\Download\988977.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\417874.exe"C:\Users\Admin\AppData\Roaming\Download\417874.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\417874.exe"C:\Users\Admin\AppData\Roaming\Download\417874.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\811305.exe"C:\Users\Admin\AppData\Roaming\Download\811305.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\811305.exe"C:\Users\Admin\AppData\Roaming\Download\811305.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\687445.exe"C:\Users\Admin\AppData\Roaming\Download\687445.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\687445.exe"C:\Users\Admin\AppData\Roaming\Download\687445.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\178250.exe"C:\Users\Admin\AppData\Roaming\Download\178250.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\178250.exe"C:\Users\Admin\AppData\Roaming\Download\178250.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\417157.exe"C:\Users\Admin\AppData\Roaming\Download\417157.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\417157.exe"C:\Users\Admin\AppData\Roaming\Download\417157.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\807761.exe"C:\Users\Admin\AppData\Roaming\Download\807761.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\807761.exe"C:\Users\Admin\AppData\Roaming\Download\807761.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\396485.exe"C:\Users\Admin\AppData\Roaming\Download\396485.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\396485.exe"C:\Users\Admin\AppData\Roaming\Download\396485.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\541468.exe"C:\Users\Admin\AppData\Roaming\Download\541468.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\541468.exe"C:\Users\Admin\AppData\Roaming\Download\541468.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\538703.exe"C:\Users\Admin\AppData\Roaming\Download\538703.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\538703.exe"C:\Users\Admin\AppData\Roaming\Download\538703.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\371959.exe"C:\Users\Admin\AppData\Roaming\Download\371959.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\371959.exe"C:\Users\Admin\AppData\Roaming\Download\371959.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\733643.exe"C:\Users\Admin\AppData\Roaming\Download\733643.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\733643.exe"C:\Users\Admin\AppData\Roaming\Download\733643.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\134367.exe"C:\Users\Admin\AppData\Roaming\Download\134367.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\134367.exe"C:\Users\Admin\AppData\Roaming\Download\134367.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\524971.exe"C:\Users\Admin\AppData\Roaming\Download\524971.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\524971.exe"C:\Users\Admin\AppData\Roaming\Download\524971.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\870154.exe"C:\Users\Admin\AppData\Roaming\Download\870154.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\870154.exe"C:\Users\Admin\AppData\Roaming\Download\870154.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\269868.exe"C:\Users\Admin\AppData\Roaming\Download\269868.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\269868.exe"C:\Users\Admin\AppData\Roaming\Download\269868.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\394749.exe"C:\Users\Admin\AppData\Roaming\Download\394749.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\394749.exe"C:\Users\Admin\AppData\Roaming\Download\394749.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\985453.exe"C:\Users\Admin\AppData\Roaming\Download\985453.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\985453.exe"C:\Users\Admin\AppData\Roaming\Download\985453.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\244352.exe"C:\Users\Admin\AppData\Roaming\Download\244352.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\244352.exe"C:\Users\Admin\AppData\Roaming\Download\244352.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\390415.exe"C:\Users\Admin\AppData\Roaming\Download\390415.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\390415.exe"C:\Users\Admin\AppData\Roaming\Download\390415.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\094044.exe"C:\Users\Admin\AppData\Roaming\Download\094044.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\094044.exe"C:\Users\Admin\AppData\Roaming\Download\094044.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\119926.exe"C:\Users\Admin\AppData\Roaming\Download\119926.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\119926.exe"C:\Users\Admin\AppData\Roaming\Download\119926.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\753372.exe"C:\Users\Admin\AppData\Roaming\Download\753372.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\753372.exe"C:\Users\Admin\AppData\Roaming\Download\753372.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\108353.exe"C:\Users\Admin\AppData\Roaming\Download\108353.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\108353.exe"C:\Users\Admin\AppData\Roaming\Download\108353.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\509967.exe"C:\Users\Admin\AppData\Roaming\Download\509967.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\509967.exe"C:\Users\Admin\AppData\Roaming\Download\509967.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\758846.exe"C:\Users\Admin\AppData\Roaming\Download\758846.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\758846.exe"C:\Users\Admin\AppData\Roaming\Download\758846.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\984029.exe"C:\Users\Admin\AppData\Roaming\Download\984029.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\984029.exe"C:\Users\Admin\AppData\Roaming\Download\984029.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\333826.exe"C:\Users\Admin\AppData\Roaming\Download\333826.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\333826.exe"C:\Users\Admin\AppData\Roaming\Download\333826.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\875355.exe"C:\Users\Admin\AppData\Roaming\Download\875355.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\875355.exe"C:\Users\Admin\AppData\Roaming\Download\875355.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\470591.exe"C:\Users\Admin\AppData\Roaming\Download\470591.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\470591.exe"C:\Users\Admin\AppData\Roaming\Download\470591.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\070495.exe"C:\Users\Admin\AppData\Roaming\Download\070495.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\070495.exe"C:\Users\Admin\AppData\Roaming\Download\070495.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\676640.exe"C:\Users\Admin\AppData\Roaming\Download\676640.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\676640.exe"C:\Users\Admin\AppData\Roaming\Download\676640.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x374,0x7ffafe11c188,0x7ffafe11c194,0x7ffafe11c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,5898364588068105728,7270652988584508350,262144 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,78204996623611500,1419226164353078940,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,12495692401219917581,16077459476337681684,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,17531942240725096716,7029318160798916799,2097152 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,17753040361227673328,1394465119793776070,2097152 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8297240370839202758,5088454189065481939,2097152 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,14285020491449399231,12402727408280934203,2097152 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4670396065970547410,18316672238742093803,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5276,i,9189280645162221526,3159848690709684385,2097152 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,10176111913148270060,17784402010177230100,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,1020304263895592998,10654457754210884861,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,5353087449088727946,2106021067694829565,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,5353087449088727946,2106021067694829565,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,12837730089127404075,9126853619339371591,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6095616943096776500,3769171549494917635,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,11102748434628417942,12497371611438822023,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,3910628719441626233,7622971352893472401,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,3286333628160174677,10888110584939337178,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,2695676711456192722,7630405649773848726,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7139108013772299491,5681064350254866888,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2776,i,6528574769649155990,16998166238488851649,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,18063995609898909716,12505608865750833285,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3269311961357826468,16677709451071421823,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,16551169342177748993,18219649639058491560,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5492,i,1605652513058144569,17921828949995225146,262144 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9578531508071161021,5965147688784643881,524288 --field-trial-handle=2268,i,16618903532943236117,2872225037647731352,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
026e89f9-0127-40bf-8037-919610caf04b.tmp
17b41ccb-5bcb-4d30-af1f-1bd854efe40e.tmp
2ff8918c-7d50-48fe-89c9-e83091922ea4.tmp
9c4cde83-fb9f-4815-815e-b85ac9fc510f.tmp
settings.dat
settings.dat
212a5d22-a999-44dd-9515-ba3b6364f815.tmp
75c35d81-ec90-4d23-a9fc-23e0b2657f76.tmp
LOG.old
f_00004a
temp-index
the-real-index
cb001956-0b6f-43ab-84d5-5823ab26c772.tmp
dasherSettingSchema.json
882a19ef-80c4-4bb6-97dd-0331ff577906.tmp
99045a7f-f7b7-4224-97a9-b4b477ec78bf.tmp
Network Persistent State
b312300e-cfe3-4cb3-9272-79c7262c2763.tmp
de11a855-8e79-4ba3-b51d-47e5c7db5569.tmp
f7e9a034-3a62-4265-9d08-b4d18efc271f.tmp
f8c61378-c52b-43c4-b42c-9cfbf5e4c3e8.tmp
a9ab8e1b-dd86-425f-b6b9-d67a2579483f.tmp
1c9859c8-43c4-4bbc-9f3a-2b761d58c31b.tmp
metadata.json
e265daea-74f3-488a-b2c5-88e9defef53b.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
6121fbbd-c032-40d4-b535-dbbbfa8ffb60.tmp
903e7685-935b-4da6-b90b-b5b55ecf7808.tmp
hao.360[1].xml
hao.360[1].xml
hao.360[1].xml
0[1].png
sed_api_weather_info[1].htm
time[1].js
0155758c-81b0-4c5c-b62b-3eabf1f336c3.tmp
d8597cdf-5f5f-46e8-af44-b383a44dbaec.tmp
ldsajdklsajdlkjsalkda.bat
content.js
messages.json
yuczjc.exe
069257.exe
091509.exe
107246.exe
147523.exe
215430.exe
297400.exe
345662.exe
376173.exe
458500.exe
564020.exe
571645.exe
933469.exe
964502.exe
manifest.json
manifest.json
manifest.json
memory/4636-1210-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1168-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1117-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1046-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1295-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-993-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1332-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-951-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1379-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-1417-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4636-281-0x0000000000400000-0x000000000059A000-memory.dmp
memory/4948-197-0x0000000000400000-0x000000000059A000-memory.dmp