3d56bfe29bd17fd6414ba16790700b2aea7059560e271916436be8442224e0eb

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.9MB
Sample261024-267dfaex3n
SHA256 3d56bfe29bd17fd6414ba16790700b2aea7059560e271916436be8442224e0eb
MD5 0223e9059a419bc6895619507bc2a8b9
SHA1 b6528c0bc18553775156e8ff866ca1072ebd99cd
SHA512 81a728e6173d4788e3fd18b83efec95ed86f160e5e52cfb059b2d7697fb3044b8c411da8b3ac9759a8cb6028bb9a2a74278349d72c346085795cf016e9d5a53f
SSDEEP 24576:J2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSSJlh9bD8RpB72U:jdGXpiQSfYJif/4q
TLSH
T1E7D53B007740412AD9F722B50BAEA12C651CFDD05314A2DB61C96BFEAB746F03D396AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	base.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	base.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	base.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	base.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 13 IoCs

pid	Process
2180	base.sfx.part01.exe
3260	base.exe
3520	svchost.exe
2512	base.exe
4468	svchost.exe
4016	base.exe
3908	svchost.exe
5112	base.exe
6128	snotes.exe
5860	snotes.exe
5852	snotes.exe
620	snotes.exe
5004	snotes.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\e:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\r:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\h:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\k:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\p:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\n:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\i:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\j:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\e:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\g:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\o:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\u:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\z:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\y:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\w:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\e:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\t:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\x:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\9B14.tmp.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\9B14.tmp.exe	svchost.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\base.sfx.part01.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part03.rar	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\storage.dll	snotes.exe
File created	C:\Windows\IME\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240685437	base.sfx.part01.exe
File created	C:\Windows\base.exe	base.sfx.part01.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\base.sfx.part02.rar	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	base.sfx.part01.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part04.rar	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	base.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snotes.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
1292	taskkill.exe
5320	taskkill.exe
1292	taskkill.exe
2252	taskkill.exe
3052	taskkill.exe
4568	taskkill.exe
5280	taskkill.exe
4560	taskkill.exe
1828	taskkill.exe
2628	taskkill.exe
3492	taskkill.exe
4012	taskkill.exe
1592	taskkill.exe
4564	taskkill.exe
1952	taskkill.exe
2980	taskkill.exe
5708	taskkill.exe
2468	taskkill.exe
2268	taskkill.exe
5344	taskkill.exe
432	taskkill.exe
1832	taskkill.exe
3884	taskkill.exe
5352	taskkill.exe
2960	taskkill.exe
4604	taskkill.exe
4236	taskkill.exe
3972	taskkill.exe
1936	taskkill.exe
3924	taskkill.exe
1980	taskkill.exe
2592	taskkill.exe
1428	taskkill.exe
5312	taskkill.exe
5288	taskkill.exe
4608	taskkill.exe
4776	taskkill.exe
5712	taskkill.exe
4724	taskkill.exe
1968	taskkill.exe
5552	taskkill.exe
4700	taskkill.exe
4100	taskkill.exe
5528	taskkill.exe
2284	taskkill.exe
4516	taskkill.exe
4740	taskkill.exe
3508	taskkill.exe
3804	taskkill.exe
5564	taskkill.exe
5692	taskkill.exe
596	taskkill.exe
5336	taskkill.exe
4128	taskkill.exe
1972	taskkill.exe
4972	taskkill.exe
1572	taskkill.exe
5984	taskkill.exe
864	taskkill.exe
5808	taskkill.exe
5328	taskkill.exe
4276	taskkill.exe
1000	taskkill.exe
4328	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	base.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	snotes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	snotes.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
3520	svchost.exe
3520	svchost.exe
3260	base.exe
3260	base.exe
3520	svchost.exe
3520	svchost.exe
3520	svchost.exe
3520	svchost.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
2512	base.exe
3260	base.exe
3260	base.exe
2512	base.exe
2512	base.exe
3260	base.exe
3260	base.exe
2512	base.exe
2512	base.exe
3260	base.exe
3260	base.exe
2512	base.exe
2512	base.exe
3260	base.exe
3260	base.exe
2512	base.exe
2512	base.exe
3260	base.exe
3260	base.exe
2512	base.exe
2512	base.exe
3260	base.exe
3260	base.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeShutdownPrivilege	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	3804	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	3520	svchost.exe
Token: SeShutdownPrivilege	3520	svchost.exe
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	864	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	4468	svchost.exe
Token: SeShutdownPrivilege	4468	svchost.exe
Token: SeDebugPrivilege	3908	svchost.exe
Token: SeShutdownPrivilege	3908	svchost.exe
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	5280	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	5328	taskkill.exe
Token: SeDebugPrivilege	5344	taskkill.exe
Token: SeDebugPrivilege	5288	taskkill.exe
Token: SeDebugPrivilege	5320	taskkill.exe
Token: SeDebugPrivilege	5312	taskkill.exe
Token: SeDebugPrivilege	5296	taskkill.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	5352	taskkill.exe
Token: SeDebugPrivilege	5860	snotes.exe
Token: SeDebugPrivilege	6128	snotes.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	3804	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	5552	taskkill.exe
Token: SeDebugPrivilege	5564	taskkill.exe
Token: SeDebugPrivilege	5544	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2180	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	84
PID 1128 wrote to memory of 3180	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	85
PID 1128 wrote to memory of 3856	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	86
PID 1128 wrote to memory of 432	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	87
PID 1128 wrote to memory of 3492	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 1128 wrote to memory of 1000	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 1128 wrote to memory of 1972	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 1128 wrote to memory of 4516	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 1128 wrote to memory of 4568	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 1128 wrote to memory of 3804	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	93
PID 1128 wrote to memory of 1188	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 1128 wrote to memory of 4768	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 1128 wrote to memory of 1724	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 1128 wrote to memory of 1952	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 1128 wrote to memory of 3540	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 1128 wrote to memory of 4560	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	173
PID 1128 wrote to memory of 4724	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	174
PID 1128 wrote to memory of 1620	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	175
PID 1128 wrote to memory of 4276	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	176
PID 1128 wrote to memory of 4608	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	177
PID 1128 wrote to memory of 1292	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	178
PID 1128 wrote to memory of 3260	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	126
PID 1128 wrote to memory of 3520	1128	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	127
PID 3520 wrote to memory of 2512	3520	svchost.exe	128
PID 3520 wrote to memory of 4128	3520	svchost.exe	129
PID 3520 wrote to memory of 3508	3520	svchost.exe	130
PID 3520 wrote to memory of 864	3520	svchost.exe	131
PID 3520 wrote to memory of 5092	3520	svchost.exe	132
PID 3520 wrote to memory of 2628	3520	svchost.exe	133
PID 3520 wrote to memory of 1968	3520	svchost.exe	134
PID 3520 wrote to memory of 2284	3520	svchost.exe	135
PID 3520 wrote to memory of 1828	3520	svchost.exe	136
PID 3520 wrote to memory of 2252	3520	svchost.exe	137
PID 3520 wrote to memory of 4564	3520	svchost.exe	138
PID 3520 wrote to memory of 2308	3520	svchost.exe	139
PID 3520 wrote to memory of 3096	3520	svchost.exe	140
PID 3520 wrote to memory of 3380	3520	svchost.exe	141
PID 3520 wrote to memory of 3396	3520	svchost.exe	142
PID 3520 wrote to memory of 2072	3520	svchost.exe	143
PID 3520 wrote to memory of 2276	3520	svchost.exe	144
PID 3520 wrote to memory of 1432	3520	svchost.exe	145
PID 3520 wrote to memory of 3012	3520	svchost.exe	146
PID 3520 wrote to memory of 5048	3520	svchost.exe	147
PID 3520 wrote to memory of 2472	3520	svchost.exe	148
PID 4468 wrote to memory of 4016	4468	svchost.exe	171
PID 4468 wrote to memory of 3908	4468	svchost.exe	172
PID 4468 wrote to memory of 4560	4468	svchost.exe	173
PID 4468 wrote to memory of 4724	4468	svchost.exe	174
PID 4468 wrote to memory of 1620	4468	svchost.exe	175
PID 4468 wrote to memory of 4276	4468	svchost.exe	176
PID 4468 wrote to memory of 4608	4468	svchost.exe	177
PID 4468 wrote to memory of 1292	4468	svchost.exe	178
PID 4468 wrote to memory of 3972	4468	svchost.exe	179
PID 4468 wrote to memory of 2960	4468	svchost.exe	180
PID 4468 wrote to memory of 1272	4468	svchost.exe	181
PID 4468 wrote to memory of 4740	4468	svchost.exe	182
PID 4468 wrote to memory of 2116	4468	svchost.exe	183
PID 4468 wrote to memory of 3348	4468	svchost.exe	184
PID 4468 wrote to memory of 2396	4468	svchost.exe	185
PID 4468 wrote to memory of 4272	4468	svchost.exe	186
PID 4468 wrote to memory of 4548	4468	svchost.exe	187
PID 4468 wrote to memory of 1844	4468	svchost.exe	188
PID 4468 wrote to memory of 2792	4468	svchost.exe	189
PID 4468 wrote to memory of 2268	4468	svchost.exe	190

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\base.sfx.part01.exe
  "C:\\Windows\\base.sfx.part01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2180
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1952
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:3540
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:4560
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:4724
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:1620
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:4276
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4608
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:1292
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    PID:5852
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2512
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:5860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3012
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5484
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1532
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:5984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:4776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5692
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5976
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:5760
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4608
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3780

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  PID:4016
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    PID:620
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies registry class
    PID:5112
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5368
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5376
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5416
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5428
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:5808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:4604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1952
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:392
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:4100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:1428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:5712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:3884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:4236
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:980
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4092
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:5920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3348
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:2396
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:4272
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:4548
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:1844
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:2792
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:2268
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968

C:\Windows\snotes.exe
C:\Windows\snotes.exe
1⤵
- Executes dropped EXE
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

authorize[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VIJY9X14\authorize[1].htm
Size 49KB
SHA256 a5df428c1d64451e7de4db8ac01c69dd66c97869d3e90c0d86ea8693f28f0781
MD5 d083ebe04f16b70d210358862c70665b
SHA1 35eabf51b3aac573b982c33ae3f4a556b33d5b1d
SHA512 2571219d1aba7f83cef2737cf3cd8098c168801dfc70b0e9bf6ca0c7100dae10f65043c5e51f025cd669e8578166a6ef09dbb5f1c64b55fe664b53607a8c1fcd
SSDEEP 1536:tTFczX8GLG278bZfaSZZXAFzZTh5EdBpZ9Tjuokmap5vPozIuFbU:QD8GyZfaSZZXAFzZTUdba/As
TLSH
T1BA337CEA7B94342BCB536575C5AF7706E97D09539848CCD4F1CC888D1EFAAEA4223903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9289.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\9289.tmp.exe
Size 16B
SHA256 d577799da44777abc2f18a26daf99904fec908cb492a078ec599cfb75d7f7bf6
MD5 c4b9e0fe1d6ac9d7cacfc60e9ca01853
SHA1 74963c794ea90fb254397633d4c8929f8fe44ff7
SHA512 6b159f30352aad93166b7744370e9653c8bde40a953e4ef263871f26cf3719ac3dd3442bec87b11490727621f4b0ca7ad4dbb53c869996ceafd86ee613a623b3
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.9MB
SHA256 4837a8e579c3c2e5cfd034353897d263291a66c2b7fa6919af7ad2e6cc56c66c
MD5 fcd519bce802b2353dac72c7fad4839e
SHA1 7ad12ee62b64b97354c59a9d33a5e9e0390fff94
SHA512 81385c3c6739bdab2d9f52f7d4f89e2296d8f44349fc775e97b388b294b1cf2db27b1a75c7c9de750b6a772a6f4b4dc95ed948bad366276c7445c831a633ba7c
SSDEEP 24576:J2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSSJlh9bD8RpB72/:jdGXpiQSfYJif/49
TLSH
T113D53B007740412AD9F722B50BAEA12C651CFDD05314A2DB61C96BFEAB746F03D396AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\INF\svchost.exe
Size 2.9MB
SHA256 3d56bfe29bd17fd6414ba16790700b2aea7059560e271916436be8442224e0eb
MD5 0223e9059a419bc6895619507bc2a8b9
SHA1 b6528c0bc18553775156e8ff866ca1072ebd99cd
SHA512 81a728e6173d4788e3fd18b83efec95ed86f160e5e52cfb059b2d7697fb3044b8c411da8b3ac9759a8cb6028bb9a2a74278349d72c346085795cf016e9d5a53f
SSDEEP 24576:J2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSSJlh9bD8RpB72U:jdGXpiQSfYJif/4q
TLSH
T1E7D53B007740412AD9F722B50BAEA12C651CFDD05314A2DB61C96BFEAB746F03D396AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.exe

Path C:\Windows\base.exe
Size 115KB
SHA256 e79865cb9fc8e0e264163c2a96479f96e732ba1e9e22cc1c562761ab0c34d41b
MD5 55979fd18ae7b8562dfe77819bb97fb2
SHA1 0f9b914ddf18abc43002ec0b5ae912d72293b294
SHA512 ab8bc73fd7e9167d02c91594f398028e5089c21f27377e02f81c8d4e80d56113f1026523c1101a82e0e76b51d328ef9f09e7b4aaa5aa780286045e9dfa826b25
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T152C3F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part01.exe

Path C:\Windows\base.sfx.part01.exe
Size 253KB
SHA256 c52b503f6669c833820c92d66dfc3fb0a8781dbf9b9065e42b5d08696932ae93
MD5 f294b8ca88754b1e2cdc02d8765b7d0e
SHA1 64620bf981a8876563aa249a1a67c41e9e75b2d7
SHA512 0f8bc0f21886f7568e01d22eb9d3a4e72893f48ef9bd2bac984ceadeb1792fea9ba2a10d2115eae68b8fa4e856dc15fb80fa37626bcfda42036e2dae99918835
SSDEEP 6144:Mc0h522p3l04ZMSmIp3Uy28uhyOtF5R3:ahxp3lZnT9bD8R3
TLSH
T1FA44BF12BAC2C8B3D53218355929EB15A97C79200F69DE9FA7D40D3EEE301D06625FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part02.rar

Path C:\Windows\base.sfx.part02.rar
Size 10KB
SHA256 216bdad3ee7908ab436d4c921f93adf52ad73be7be186da66d96bfcf89bd24d9
MD5 a30552e931d79d550df1c8f9fce7fa79
SHA1 3a8a5ceadd2c6ab7a0c565223937de74750fe934
SHA512 ae096afbdfed88b6c17361ad1313ac996ff840b2289de4b6572e35dac8a8af7d6b006f2f76a37a28a225a03ec890119edd51c96705b9cf0fd35da34c927ba0cb
SSDEEP 192:uSEQ1ZSf7O11NCBvUaNCMRu2CCLg/3xVhffdsGyCeXcDU4hSHn68mDTWeUXI9MAL:B/1ZN11kFU1MsiLg/BvZ7IcDaHnDSWdD
TLSH
T11D22CFC4985D63F9D37B0235A822D38D7D34E583321E5832B4D98C279D518A89EC4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part03.rar

Path C:\Windows\base.sfx.part03.rar
Size 10KB
SHA256 9e2bae5cb3c26a38f38a4364cdf708121e4aaa2f5519e67f6287e4dfa311a9bf
MD5 7bf0b2c4a28ceb748c7406556a61b698
SHA1 ed6704a932053909c6eaf27b134644cf449d3fad
SHA512 a36aa329b091804a6b4af8c56fd32fb7618aafa0e133753972d4f17a940e006e698750a10ac4423ef8cd3746202a0e17b99876f5b503a9c1edaad1e10e361702
SSDEEP 192:WSHqKYN/gKVMesSovtAkNAnJUFmyU+CyqSHhAUlh+YnJ6KvLusrnqSMb:hrMrVwSWtAtJqmcES+qcYJ6KTuszrM
TLSH
T18722C03B2098758BC5912A7198CF547B5401E9FABE317B96022B9E13BAA1291D1FF1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part04.rar

Path C:\Windows\base.sfx.part04.rar
Size 9KB
SHA256 603942cfbd2c60faa571b4fc939c334636484d9c3825910252f7b9a503a4b020
MD5 d3a9c4f54c9d223227a5f19f80061c1b
SHA1 4a36584282dcb34201ff47f5c1ae291ad381a4e6
SHA512 c45ab824955a2c2efd67fa1c0b09bf4c233fe41d7f5dd2aaca584e742fc2be18b37f650f88b1b70ab2b4de8a35eebaf79a624c470d475277902dace10af1c018
SSDEEP 192:ttzpJJUdDREaz0lpH8DJw7EhzE+EH2Q1HfVkztVSihKRGgCp+qB8BdL1zZ/:npJKdDRSlNUf4RNfVOhiG5Qqav1zZ/
TLSH
T19712AF40656F5F2285BB3220EEACB390C72505BDC9DA6C2DE83976943311DDEE460765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 50.1MB
SHA256 9bd6f4a797d6b068c67fa9e8f08efd7540f296fb783f989033c224e090c09276
MD5 606e73c8dfb61b814b245cd43d029d6d
SHA1 30246168b536f84480ae87ae32bdeab04cda0a58
SHA512 4417b9be041b2086c5fa0160a9b71eb6f5f4280960e7fe1c34bde363fee6ce4f8088306e1587b040b1a5b04b7fc22f26424fcfa3453609dc74c91b7c4899fbec
SSDEEP 98304:3yJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJc:j
TLSH
T124B70244635E7CE4C28027C4B34B9CC8B075FABD3BD889796D6C9A126D980DD3578EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-92-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1128-44-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/1128-0-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/1128-1-0x0000000000676000-0x0000000000678000-memory.dmp

Download

memory/2512-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2512-79-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3260-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3260-77-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3520-38-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/3520-78-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/3908-67-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/3908-81-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/4016-66-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4016-80-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4468-71-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/4468-57-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/5004-93-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5112-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5112-82-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5852-88-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5860-86-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5860-94-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6128-85-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6128-90-0x0000000000400000-0x0000000000431000-memory.dmp

Download