3d56bfe29bd17fd6414ba16790700b2aea7059560e271916436be8442224e0eb

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.9MB
Sample261024-267dfaex3n
SHA256 3d56bfe29bd17fd6414ba16790700b2aea7059560e271916436be8442224e0eb
MD5 0223e9059a419bc6895619507bc2a8b9
SHA1 b6528c0bc18553775156e8ff866ca1072ebd99cd
SHA512 81a728e6173d4788e3fd18b83efec95ed86f160e5e52cfb059b2d7697fb3044b8c411da8b3ac9759a8cb6028bb9a2a74278349d72c346085795cf016e9d5a53f
SSDEEP 24576:J2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSSJlh9bD8RpB72U:jdGXpiQSfYJif/4q
TLSH
T1E7D53B007740412AD9F722B50BAEA12C651CFDD05314A2DB61C96BFEAB746F03D396AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 4 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 13 IoCs

pid	Process
4412	base.sfx.part01.exe
1988	base.exe
3812	svchost.exe
2004	base.exe
4656	svchost.exe
4892	base.exe
1740	svchost.exe
5528	base.exe
6984	snotes.exe
6976	snotes.exe
7048	snotes.exe
7112	snotes.exe
7132	snotes.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\o:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\q:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\h:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\g:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\v:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\x:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\j:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\p:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\z:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\i:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\y:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\n:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\m:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\k:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\r:	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File created	C:\Windows\base.sfx.part04.rar	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\base.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\796E.tmp.exe	svchost.exe
File opened for modification	C:\Windows\796E.tmp.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\base.sfx.part02.rar	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240741796	base.sfx.part01.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\base.sfx.part03.rar	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.exe	base.sfx.part01.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\inf\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\inf\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\storage.dll	snotes.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\base.exe	base.sfx.part01.exe
File created	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\IME\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\base.sfx.part01.exe	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snotes.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4908	taskkill.exe
4868	taskkill.exe
6008	taskkill.exe
920	taskkill.exe
5948	taskkill.exe
6412	taskkill.exe
6440	taskkill.exe
6320	taskkill.exe
2228	taskkill.exe
5704	taskkill.exe
4504	taskkill.exe
7076	taskkill.exe
2228	taskkill.exe
3880	taskkill.exe
4100	taskkill.exe
3932	taskkill.exe
4836	taskkill.exe
6508	taskkill.exe
4596	taskkill.exe
1652	taskkill.exe
1712	taskkill.exe
4648	taskkill.exe
4176	taskkill.exe
3024	taskkill.exe
940	taskkill.exe
3436	taskkill.exe
3952	taskkill.exe
616	taskkill.exe
4960	taskkill.exe
5556	taskkill.exe
6436	taskkill.exe
868	taskkill.exe
5636	taskkill.exe
4632	taskkill.exe
6520	taskkill.exe
1148	taskkill.exe
6884	taskkill.exe
3500	taskkill.exe
5748	taskkill.exe
2236	taskkill.exe
6040	taskkill.exe
2720	taskkill.exe
2928	taskkill.exe
672	taskkill.exe
4396	taskkill.exe
5392	taskkill.exe
3736	taskkill.exe
1260	taskkill.exe
2520	taskkill.exe
2696	taskkill.exe
4996	taskkill.exe
3200	taskkill.exe
4848	taskkill.exe
4148	taskkill.exe
5136	taskkill.exe
2580	taskkill.exe
6528	taskkill.exe
5984	taskkill.exe
2200	taskkill.exe
252	taskkill.exe
3512	taskkill.exe
3916	taskkill.exe
3348	taskkill.exe
4320	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	snotes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800000f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	snotes.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1988	base.exe
1988	base.exe
3812	svchost.exe
3812	svchost.exe
3812	svchost.exe
3812	svchost.exe
3812	svchost.exe
3812	svchost.exe
2004	base.exe
2004	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe
1988	base.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeShutdownPrivilege	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	5636	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	3812	svchost.exe
Token: SeShutdownPrivilege	3812	svchost.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	6008	taskkill.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	5748	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	4656	svchost.exe
Token: SeShutdownPrivilege	4656	svchost.exe
Token: SeDebugPrivilege	1740	svchost.exe
Token: SeShutdownPrivilege	1740	svchost.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe
Token: SeDebugPrivilege	252	taskkill.exe
Token: SeDebugPrivilege	5948	taskkill.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeDebugPrivilege	6984	snotes.exe
Token: SeDebugPrivilege	6976	snotes.exe
Token: SeDebugPrivilege	6520	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	6500	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	3952	taskkill.exe
Token: SeDebugPrivilege	6528	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	6508	taskkill.exe
Token: SeDebugPrivilege	6436	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	6412	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	6320	taskkill.exe
Token: SeDebugPrivilege	6440	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	4996	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 5636	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4712 wrote to memory of 4176	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	93
PID 4712 wrote to memory of 4908	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 4712 wrote to memory of 4836	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 4712 wrote to memory of 2228	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 4712 wrote to memory of 4848	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 4712 wrote to memory of 4412	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4712 wrote to memory of 2720	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 4712 wrote to memory of 4396	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	99
PID 4712 wrote to memory of 5984	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 4712 wrote to memory of 3500	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 4712 wrote to memory of 2556	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	112
PID 4712 wrote to memory of 5100	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	113
PID 4712 wrote to memory of 1324	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	114
PID 4712 wrote to memory of 3004	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	115
PID 4712 wrote to memory of 3200	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	194
PID 4712 wrote to memory of 240	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	117
PID 4712 wrote to memory of 3804	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	199
PID 4712 wrote to memory of 4740	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	200
PID 4712 wrote to memory of 5520	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	201
PID 4712 wrote to memory of 952	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	202
PID 4712 wrote to memory of 1988	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	133
PID 4712 wrote to memory of 3812	4712	2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	135
PID 3812 wrote to memory of 2004	3812	svchost.exe	136
PID 3812 wrote to memory of 3736	3812	svchost.exe	137
PID 3812 wrote to memory of 920	3812	svchost.exe	138
PID 3812 wrote to memory of 6008	3812	svchost.exe	139
PID 3812 wrote to memory of 2764	3812	svchost.exe	140
PID 3812 wrote to memory of 5136	3812	svchost.exe	141
PID 3812 wrote to memory of 5392	3812	svchost.exe	142
PID 3812 wrote to memory of 4868	3812	svchost.exe	143
PID 3812 wrote to memory of 2200	3812	svchost.exe	144
PID 3812 wrote to memory of 5748	3812	svchost.exe	145
PID 3812 wrote to memory of 4148	3812	svchost.exe	146
PID 3812 wrote to memory of 3124	3812	svchost.exe	147
PID 3812 wrote to memory of 3868	3812	svchost.exe	148
PID 3812 wrote to memory of 2784	3812	svchost.exe	149
PID 3812 wrote to memory of 1624	3812	svchost.exe	150
PID 3812 wrote to memory of 3860	3812	svchost.exe	151
PID 3812 wrote to memory of 3404	3812	svchost.exe	152
PID 3812 wrote to memory of 3328	3812	svchost.exe	153
PID 3812 wrote to memory of 1824	3812	svchost.exe	154
PID 3812 wrote to memory of 5008	3812	svchost.exe	155
PID 3812 wrote to memory of 3296	3812	svchost.exe	156
PID 4656 wrote to memory of 4892	4656	svchost.exe	178
PID 4656 wrote to memory of 1740	4656	svchost.exe	179
PID 4656 wrote to memory of 4632	4656	svchost.exe	180
PID 4656 wrote to memory of 2580	4656	svchost.exe	181
PID 4656 wrote to memory of 3880	4656	svchost.exe	182
PID 1740 wrote to memory of 5528	1740	svchost.exe	187
PID 1740 wrote to memory of 4880	1740	svchost.exe	188
PID 1740 wrote to memory of 3436	1740	svchost.exe	189
PID 1740 wrote to memory of 5948	1740	svchost.exe	190
PID 1740 wrote to memory of 2236	1740	svchost.exe	191
PID 1740 wrote to memory of 3512	1740	svchost.exe	192
PID 1740 wrote to memory of 2648	1740	svchost.exe	193
PID 1740 wrote to memory of 3200	1740	svchost.exe	194
PID 1740 wrote to memory of 5556	1740	svchost.exe	195
PID 1740 wrote to memory of 252	1740	svchost.exe	196
PID 1740 wrote to memory of 4960	1740	svchost.exe	197
PID 1740 wrote to memory of 2912	1740	svchost.exe	198
PID 1740 wrote to memory of 3804	1740	svchost.exe	199
PID 1740 wrote to memory of 4740	1740	svchost.exe	200
PID 1740 wrote to memory of 5520	1740	svchost.exe	201

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0223e9059a419bc6895619507bc2a8b9_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\base.sfx.part01.exe
  "C:\\Windows\\base.sfx.part01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4412
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:2556
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:3004
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:240
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:3804
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:4740
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:5520
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:952
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:6984
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2004
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3868
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:3404
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:248
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:360
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:692
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4544
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5892
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:3932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:4320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:2228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:264
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:904
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5432
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6444

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7048
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:5528
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3804
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5520
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:952
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6260
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6432
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:6452
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6312
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5256
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    PID:4504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:7076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:4648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:672
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3976
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6216
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:7144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:6856
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  PID:3916

C:\Windows\snotes.exe
C:\Windows\snotes.exe
1⤵
- Executes dropped EXE
PID:7112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

authorize[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\authorize[1].htm
Size 49KB
SHA256 a366ada09f13a805fda59ba6ea89c21feda108a86f437470b68d2a9ce224afda
MD5 13aff8d6ead1f02aa2217ff4316ae8f8
SHA1 700a14c43009625b9d3bd5652fa1426c51e57ad5
SHA512 b1883f003c10198357205974a37759b5201424f5130856c5c996656b7e671344e856083b2eb09ecddb476de358992d09db9f128dba74989b192e093afb69e5a6
SSDEEP 1536:tdM8GLG2sLGGZERbdZ1L1nL0F1Z6LyCwB8Z9Tjuokmap5vPozvuF2H:TM8NLGGZ+xZ1L1nL0F1Z6LBwIa/AF
TLSH
T126337DE67B8434278B966574C4AF3B06DA7A09539849CCD5F0DD8C9D1EFAFEA0223503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7046.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\7046.tmp.exe
Size 16B
SHA256 d577799da44777abc2f18a26daf99904fec908cb492a078ec599cfb75d7f7bf6
MD5 c4b9e0fe1d6ac9d7cacfc60e9ca01853
SHA1 74963c794ea90fb254397633d4c8929f8fe44ff7
SHA512 6b159f30352aad93166b7744370e9653c8bde40a953e4ef263871f26cf3719ac3dd3442bec87b11490727621f4b0ca7ad4dbb53c869996ceafd86ee613a623b3
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.9MB
SHA256 4837a8e579c3c2e5cfd034353897d263291a66c2b7fa6919af7ad2e6cc56c66c
MD5 fcd519bce802b2353dac72c7fad4839e
SHA1 7ad12ee62b64b97354c59a9d33a5e9e0390fff94
SHA512 81385c3c6739bdab2d9f52f7d4f89e2296d8f44349fc775e97b388b294b1cf2db27b1a75c7c9de750b6a772a6f4b4dc95ed948bad366276c7445c831a633ba7c
SSDEEP 24576:J2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSSJlh9bD8RpB72/:jdGXpiQSfYJif/49
TLSH
T113D53B007740412AD9F722B50BAEA12C651CFDD05314A2DB61C96BFEAB746F03D396AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\IME\svchost.exe
Size 2.9MB
SHA256 3d56bfe29bd17fd6414ba16790700b2aea7059560e271916436be8442224e0eb
MD5 0223e9059a419bc6895619507bc2a8b9
SHA1 b6528c0bc18553775156e8ff866ca1072ebd99cd
SHA512 81a728e6173d4788e3fd18b83efec95ed86f160e5e52cfb059b2d7697fb3044b8c411da8b3ac9759a8cb6028bb9a2a74278349d72c346085795cf016e9d5a53f
SSDEEP 24576:J2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSSJlh9bD8RpB72U:jdGXpiQSfYJif/4q
TLSH
T1E7D53B007740412AD9F722B50BAEA12C651CFDD05314A2DB61C96BFEAB746F03D396AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.exe

Path C:\Windows\base.exe
Size 115KB
SHA256 e79865cb9fc8e0e264163c2a96479f96e732ba1e9e22cc1c562761ab0c34d41b
MD5 55979fd18ae7b8562dfe77819bb97fb2
SHA1 0f9b914ddf18abc43002ec0b5ae912d72293b294
SHA512 ab8bc73fd7e9167d02c91594f398028e5089c21f27377e02f81c8d4e80d56113f1026523c1101a82e0e76b51d328ef9f09e7b4aaa5aa780286045e9dfa826b25
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T152C3F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part01.exe

Path C:\Windows\base.sfx.part01.exe
Size 253KB
SHA256 c52b503f6669c833820c92d66dfc3fb0a8781dbf9b9065e42b5d08696932ae93
MD5 f294b8ca88754b1e2cdc02d8765b7d0e
SHA1 64620bf981a8876563aa249a1a67c41e9e75b2d7
SHA512 0f8bc0f21886f7568e01d22eb9d3a4e72893f48ef9bd2bac984ceadeb1792fea9ba2a10d2115eae68b8fa4e856dc15fb80fa37626bcfda42036e2dae99918835
SSDEEP 6144:Mc0h522p3l04ZMSmIp3Uy28uhyOtF5R3:ahxp3lZnT9bD8R3
TLSH
T1FA44BF12BAC2C8B3D53218355929EB15A97C79200F69DE9FA7D40D3EEE301D06625FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part02.rar

Path C:\Windows\base.sfx.part02.rar
Size 10KB
SHA256 216bdad3ee7908ab436d4c921f93adf52ad73be7be186da66d96bfcf89bd24d9
MD5 a30552e931d79d550df1c8f9fce7fa79
SHA1 3a8a5ceadd2c6ab7a0c565223937de74750fe934
SHA512 ae096afbdfed88b6c17361ad1313ac996ff840b2289de4b6572e35dac8a8af7d6b006f2f76a37a28a225a03ec890119edd51c96705b9cf0fd35da34c927ba0cb
SSDEEP 192:uSEQ1ZSf7O11NCBvUaNCMRu2CCLg/3xVhffdsGyCeXcDU4hSHn68mDTWeUXI9MAL:B/1ZN11kFU1MsiLg/BvZ7IcDaHnDSWdD
TLSH
T11D22CFC4985D63F9D37B0235A822D38D7D34E583321E5832B4D98C279D518A89EC4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part03.rar

Path C:\Windows\base.sfx.part03.rar
Size 10KB
SHA256 9e2bae5cb3c26a38f38a4364cdf708121e4aaa2f5519e67f6287e4dfa311a9bf
MD5 7bf0b2c4a28ceb748c7406556a61b698
SHA1 ed6704a932053909c6eaf27b134644cf449d3fad
SHA512 a36aa329b091804a6b4af8c56fd32fb7618aafa0e133753972d4f17a940e006e698750a10ac4423ef8cd3746202a0e17b99876f5b503a9c1edaad1e10e361702
SSDEEP 192:WSHqKYN/gKVMesSovtAkNAnJUFmyU+CyqSHhAUlh+YnJ6KvLusrnqSMb:hrMrVwSWtAtJqmcES+qcYJ6KTuszrM
TLSH
T18722C03B2098758BC5912A7198CF547B5401E9FABE317B96022B9E13BAA1291D1FF1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part04.rar

Path C:\Windows\base.sfx.part04.rar
Size 9KB
SHA256 603942cfbd2c60faa571b4fc939c334636484d9c3825910252f7b9a503a4b020
MD5 d3a9c4f54c9d223227a5f19f80061c1b
SHA1 4a36584282dcb34201ff47f5c1ae291ad381a4e6
SHA512 c45ab824955a2c2efd67fa1c0b09bf4c233fe41d7f5dd2aaca584e742fc2be18b37f650f88b1b70ab2b4de8a35eebaf79a624c470d475277902dace10af1c018
SSDEEP 192:ttzpJJUdDREaz0lpH8DJw7EhzE+EH2Q1HfVkztVSihKRGgCp+qB8BdL1zZ/:npJKdDRSlNUf4RNfVOhiG5Qqav1zZ/
TLSH
T19712AF40656F5F2285BB3220EEACB390C72505BDC9DA6C2DE83976943311DDEE460765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 64KB
SHA256 3b9d888fbfa01f264e499f7c5a439f0a04d6ee1500298f451b96dece4bc457c3
MD5 4bd4a8a2fe35fc2ea24ddd58439f3a97
SHA1 1d7f32f360cd570fe9587f35f8cba6326892c324
SHA512 b14db6cad46adc58c6e7712b2a2e78155aaabe7062c706c62370f0ae55d76ef4df4b7a49d48f91d9126818ead44ff1e50532a05dca3f7e91857c7706b3764406
SSDEEP 768:kNM4fRGST2AxZ4nA4EHj4Xdy2i0iSi0iX+GKdHSiBlRwNu5fCwuyj26:kNM4932ArSdqoHZLR11CcK6
TLSH
T17653C525D200C1F7E8A200B26DA9ADE668C4783147CF00F7B399DF69616E3F65239D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 8.5MB
SHA256 c24ccc4a0dda968ce4cf87f96467d035a2ee28b8a8a09159c5ebaf2d1a4a7434
MD5 68e12376c2db8cb5de6c0fbeefa63856
SHA1 0e4aec076f14461c78eafa1480f6d979c20f4fd4
SHA512 c0c9872ff0a54825fbc84b33ea26554f533d118dccdc78de53c13d165edc9c1468f1b106b0e5f93895c7d45f7c416bd9df28dbbed1e088368f38b9f156ce0da7
SSDEEP 6144:MGOmtyKApF+OelHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHT:MGoA
TLSH
T1DF96AE7102667C48F0820054915D18CC61B8E4DBBB1E9E22EA7E99D3EE7E1FC48757EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 1.5MB
SHA256 c76382e1df541985dc635eaa5ccdd37595bb3c711d9f78681cf6e842cf7d89b7
MD5 9cfa70be8f8d71c68ea6d503c7bac04b
SHA1 711f4ef147ce45847ea77c3822fb867cdf7aa190
SHA512 9034306b82c07ffd9d4599d7f98e043a594d39a9ae5ca745dbec65ccd8cc3d91bd6eb84caa1d1fc8f578c21434f78edd8c59e0215e918127daddd222a3da9a83
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4m:MGrqmt41pUdHApF+Oe4m
TLSH
T11E75FA7154323890D06490B8235D44CE90BBF8AABF390DF3E4629ADBD9E78DC84F5799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 50.1MB
SHA256 9bd6f4a797d6b068c67fa9e8f08efd7540f296fb783f989033c224e090c09276
MD5 606e73c8dfb61b814b245cd43d029d6d
SHA1 30246168b536f84480ae87ae32bdeab04cda0a58
SHA512 4417b9be041b2086c5fa0160a9b71eb6f5f4280960e7fe1c34bde363fee6ce4f8088306e1587b040b1a5b04b7fc22f26424fcfa3453609dc74c91b7c4899fbec
SSDEEP 98304:3yJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJc:j
TLSH
T124B70244635E7CE4C28027C4B34B9CC8B075FABD3BD889796D6C9A126D980DD3578EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1740-57-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/1988-19-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1988-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2004-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3812-54-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/4656-46-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/4712-0-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/4712-28-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/4712-1-0x0000000000676000-0x0000000000678000-memory.dmp

Download

memory/4892-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4892-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5528-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6976-64-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6984-68-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/7048-65-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/7112-66-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/7132-67-0x0000000000400000-0x0000000000431000-memory.dmp

Download