Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 06:56
General
- Target 2026-10-26_c8a929bd61cc211f63c2376225241666_elex_emotet_icedid_krbanker_remcos_stop.exe
- Size 1.5MB
- Sample261027-hqr42abs21
- SHA256 9b03cfc4987e343af2d6ae6d63c3f151c03ba74067a58a643c3f636a3d915129
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_c8a929bd61cc211f63c2376225241666_elex_emotet_icedid_krbanker_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_c8a929bd61cc211f63c2376225241666_elex_emotet_icedid_krbanker_remcos_stop.exe"1⤵
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\jpsrhh.exe"C:\Users\Admin\AppData\Local\Temp\jpsrhh.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jpsrhh.exe"C:\Users\Admin\AppData\Local\Temp\jpsrhh.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\477051.exe"C:\Users\Admin\AppData\Roaming\Download\477051.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\477051.exe"C:\Users\Admin\AppData\Roaming\Download\477051.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\210561.exe"C:\Users\Admin\AppData\Roaming\Download\210561.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\210561.exe"C:\Users\Admin\AppData\Roaming\Download\210561.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\524639.exe"C:\Users\Admin\AppData\Roaming\Download\524639.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\524639.exe"C:\Users\Admin\AppData\Roaming\Download\524639.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\345222.exe"C:\Users\Admin\AppData\Roaming\Download\345222.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\345222.exe"C:\Users\Admin\AppData\Roaming\Download\345222.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\674654.exe"C:\Users\Admin\AppData\Roaming\Download\674654.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\674654.exe"C:\Users\Admin\AppData\Roaming\Download\674654.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\023432.exe"C:\Users\Admin\AppData\Roaming\Download\023432.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\023432.exe"C:\Users\Admin\AppData\Roaming\Download\023432.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\148040.exe"C:\Users\Admin\AppData\Roaming\Download\148040.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\148040.exe"C:\Users\Admin\AppData\Roaming\Download\148040.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\497940.exe"C:\Users\Admin\AppData\Roaming\Download\497940.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\497940.exe"C:\Users\Admin\AppData\Roaming\Download\497940.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\977534.exe"C:\Users\Admin\AppData\Roaming\Download\977534.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\977534.exe"C:\Users\Admin\AppData\Roaming\Download\977534.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\809501.exe"C:\Users\Admin\AppData\Roaming\Download\809501.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\809501.exe"C:\Users\Admin\AppData\Roaming\Download\809501.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\209215.exe"C:\Users\Admin\AppData\Roaming\Download\209215.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\209215.exe"C:\Users\Admin\AppData\Roaming\Download\209215.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\555397.exe"C:\Users\Admin\AppData\Roaming\Download\555397.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\555397.exe"C:\Users\Admin\AppData\Roaming\Download\555397.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\180743.exe"C:\Users\Admin\AppData\Roaming\Download\180743.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\180743.exe"C:\Users\Admin\AppData\Roaming\Download\180743.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\420530.exe"C:\Users\Admin\AppData\Roaming\Download\420530.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\420530.exe"C:\Users\Admin\AppData\Roaming\Download\420530.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\818255.exe"C:\Users\Admin\AppData\Roaming\Download\818255.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\818255.exe"C:\Users\Admin\AppData\Roaming\Download\818255.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\277032.exe"C:\Users\Admin\AppData\Roaming\Download\277032.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\277032.exe"C:\Users\Admin\AppData\Roaming\Download\277032.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\423014.exe"C:\Users\Admin\AppData\Roaming\Download\423014.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\423014.exe"C:\Users\Admin\AppData\Roaming\Download\423014.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\713729.exe"C:\Users\Admin\AppData\Roaming\Download\713729.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\713729.exe"C:\Users\Admin\AppData\Roaming\Download\713729.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\149901.exe"C:\Users\Admin\AppData\Roaming\Download\149901.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\149901.exe"C:\Users\Admin\AppData\Roaming\Download\149901.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\530515.exe"C:\Users\Admin\AppData\Roaming\Download\530515.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\530515.exe"C:\Users\Admin\AppData\Roaming\Download\530515.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\431866.exe"C:\Users\Admin\AppData\Roaming\Download\431866.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\431866.exe"C:\Users\Admin\AppData\Roaming\Download\431866.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\911578.exe"C:\Users\Admin\AppData\Roaming\Download\911578.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\911578.exe"C:\Users\Admin\AppData\Roaming\Download\911578.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\574824.exe"C:\Users\Admin\AppData\Roaming\Download\574824.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\574824.exe"C:\Users\Admin\AppData\Roaming\Download\574824.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\661262.exe"C:\Users\Admin\AppData\Roaming\Download\661262.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\661262.exe"C:\Users\Admin\AppData\Roaming\Download\661262.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\404516.exe"C:\Users\Admin\AppData\Roaming\Download\404516.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\404516.exe"C:\Users\Admin\AppData\Roaming\Download\404516.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\408773.exe"C:\Users\Admin\AppData\Roaming\Download\408773.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\408773.exe"C:\Users\Admin\AppData\Roaming\Download\408773.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\809398.exe"C:\Users\Admin\AppData\Roaming\Download\809398.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\809398.exe"C:\Users\Admin\AppData\Roaming\Download\809398.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\935370.exe"C:\Users\Admin\AppData\Roaming\Download\935370.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\935370.exe"C:\Users\Admin\AppData\Roaming\Download\935370.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\770714.exe"C:\Users\Admin\AppData\Roaming\Download\770714.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\770714.exe"C:\Users\Admin\AppData\Roaming\Download\770714.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\884061.exe"C:\Users\Admin\AppData\Roaming\Download\884061.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\884061.exe"C:\Users\Admin\AppData\Roaming\Download\884061.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\417207.exe"C:\Users\Admin\AppData\Roaming\Download\417207.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\417207.exe"C:\Users\Admin\AppData\Roaming\Download\417207.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\520758.exe"C:\Users\Admin\AppData\Roaming\Download\520758.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\520758.exe"C:\Users\Admin\AppData\Roaming\Download\520758.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\999360.exe"C:\Users\Admin\AppData\Roaming\Download\999360.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\999360.exe"C:\Users\Admin\AppData\Roaming\Download\999360.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\045343.exe"C:\Users\Admin\AppData\Roaming\Download\045343.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\045343.exe"C:\Users\Admin\AppData\Roaming\Download\045343.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\880799.exe"C:\Users\Admin\AppData\Roaming\Download\880799.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\880799.exe"C:\Users\Admin\AppData\Roaming\Download\880799.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\936871.exe"C:\Users\Admin\AppData\Roaming\Download\936871.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\936871.exe"C:\Users\Admin\AppData\Roaming\Download\936871.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\285759.exe"C:\Users\Admin\AppData\Roaming\Download\285759.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\285759.exe"C:\Users\Admin\AppData\Roaming\Download\285759.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\989280.exe"C:\Users\Admin\AppData\Roaming\Download\989280.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\989280.exe"C:\Users\Admin\AppData\Roaming\Download\989280.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\114262.exe"C:\Users\Admin\AppData\Roaming\Download\114262.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\114262.exe"C:\Users\Admin\AppData\Roaming\Download\114262.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\758606.exe"C:\Users\Admin\AppData\Roaming\Download\758606.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\758606.exe"C:\Users\Admin\AppData\Roaming\Download\758606.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\762753.exe"C:\Users\Admin\AppData\Roaming\Download\762753.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\762753.exe"C:\Users\Admin\AppData\Roaming\Download\762753.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\507109.exe"C:\Users\Admin\AppData\Roaming\Download\507109.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\507109.exe"C:\Users\Admin\AppData\Roaming\Download\507109.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\856997.exe"C:\Users\Admin\AppData\Roaming\Download\856997.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\856997.exe"C:\Users\Admin\AppData\Roaming\Download\856997.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\015896.exe"C:\Users\Admin\AppData\Roaming\Download\015896.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\015896.exe"C:\Users\Admin\AppData\Roaming\Download\015896.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\745325.exe"C:\Users\Admin\AppData\Roaming\Download\745325.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\745325.exe"C:\Users\Admin\AppData\Roaming\Download\745325.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\074102.exe"C:\Users\Admin\AppData\Roaming\Download\074102.exe" /Shorttailedrestart4⤵
-
C:\Users\Admin\AppData\Roaming\Download\074102.exe"C:\Users\Admin\AppData\Roaming\Download\074102.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\Download\985653.exe"C:\Users\Admin\AppData\Roaming\Download\985653.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\985653.exe"C:\Users\Admin\AppData\Roaming\Download\985653.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\576267.exe"C:\Users\Admin\AppData\Roaming\Download\576267.exe" /Shorttailedrestart4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Download\576267.exe"C:\Users\Admin\AppData\Roaming\Download\576267.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x36c,0x7ffcf4cdc188,0x7ffcf4cdc194,0x7ffcf4cdc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,12204842306223632057,16803390564886322674,262144 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,5531610451030176658,12801621975920972667,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,13835795368378744523,6905770143333708167,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,13307698336314219271,243354203643020923,2097152 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,6537385588149794859,7581601231862524689,2097152 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,16332725795983460593,3789277060431149886,2097152 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,18198619528484182883,1575838843853960568,2097152 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,10311543862707910631,14925651390467404850,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,14805208427904682202,14647593941225188248,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,4128818067605442260,13589809513181106818,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10276870965581918786,8712899561876251475,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10276870965581918786,8712899561876251475,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6128,i,11054329493027559367,2479351976527158266,2097152 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,6270079666499498416,2690644524806641721,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,14546982354003043899,11425036807737310171,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,12771092522074083010,17688382109698388897,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:143⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,5174756147836591361,2071852860834864124,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,12276504652529042203,13372641546075653071,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,1289482580479241769,3583513674682825783,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6588,i,7774670555000470855,2956968715365886916,2097152 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,1958462358530608107,15012457151594254759,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,18423834552774709215,15054133496991510324,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,1990060541302030742,16802279894845168034,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,15843458043638531116,16357598385863659261,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,9426585477975738441,11499307206837264278,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,12160294901257534683,15357900911140135671,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7076,i,16554771940756442704,16727298041687216489,262144 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,16341852223539868831,2045863965829161698,524288 --field-trial-handle=2172,i,15624281639710977224,5793739045894538370,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:143⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DouTuDaShi.exe
7ee3b19e-c3b8-4b49-8a48-3d50fbb986d2.tmp
8d1b1b80-8331-4939-b671-e180b508b845.tmp
settings.dat
settings.dat
4c6c4754-4f9d-434c-abd5-1f9cbdfd1ce4.tmp
68cba61c-7ab2-4082-9bc5-a3133d890d6e.tmp
6d617abd-1e54-489d-9645-8abd2a0e0d82.tmp
76a48300-6394-4021-9b91-874ada63eca8.tmp
f_000079
f_000084
temp-index
the-real-index
c5742f5a-5151-4d21-aa3b-1d6bfa993a21.tmp
dasherSettingSchema.json
013cb723-9c96-4876-a223-2e18f4edc17c.tmp
6e604848-0509-4e8e-9311-07dc62c3fd29.tmp
b1909946-e825-45a8-bcc2-0f6dff40fc37.tmp
cdffa30d-5e6c-4799-9b75-ff309e716ebd.tmp
OperationConfig
e29cf424-ab0f-48f8-913c-f841be88f78f.tmp
b42062fb-64d2-405a-b7e3-991cd34bd2cf.tmp
b7882063-f0b6-4a9b-8dd2-e7d784d459c6.tmp
aae64d1e-6ddb-40f3-bdad-74ff13622c1c.tmp
e2325257-681d-4711-97e7-25fde8bcabd9.tmp
ed756df5-2635-4602-aa85-9a4be6415914.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
5f844d0d-b624-4e40-bd6f-63daeb8edbe1.tmp
895e98a3-dc2f-41b5-96be-8fc15c313f8e.tmp
fa8198e7-aa7c-40eb-96a9-29d18cee0450.tmp
hao.360[1].xml
sed_api_weather_info[1].htm
time[1].js
0d7d3d72-909f-43a4-a4a6-12cab1432e8f.tmp
e9243f2e-0352-4a5f-aaa2-80f0fea1cdb9.tmp
jpsrhh.exe
ldsajdklsajdlkjsalkda.bat
messages.json
content.js
023432.exe
148040.exe
180743.exe
209215.exe
210561.exe
345222.exe
477051.exe
497940.exe
524639.exe
555397.exe
674654.exe
809501.exe
977534.exe
manifest.json
manifest.json
manifest.json
memory/432-169-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1126-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1224-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1254-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1168-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-811-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1306-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1337-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-418-0x0000000000400000-0x000000000059A000-memory.dmp
memory/2724-1383-0x0000000000400000-0x000000000059A000-memory.dmp