d4d373c71dd34cd5fa9905ec1eb0f8785936a4da92f94af6c144aa9c6ea4396e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Size 8.6MB
Sample261102-tfa9babt2y
SHA256 d4d373c71dd34cd5fa9905ec1eb0f8785936a4da92f94af6c144aa9c6ea4396e
MD5 864b49e68876b5ef57a39c3af913c9c2
SHA1 b6a77687db0404bc065feb59ea66d28a1ac9162d
SHA512 1c2f2ffceacb70986e5553f94f4521af486a2af437ce0c6cc1fb2b7b32d36e381a361af825e6d98ad9f38fd827a905354220fcae3fc8882a1ab702b04d59f026
SSDEEP 196608:O2PGCslfeJfWXoHdvCXW7kjMLZ9m2qojJ4Fw3P6UI:nOx61HkjMthNP3P6p
TLSH
T15A96DF1731974035C59B4230C669BEF435FABA611FA298EF6FC48D9C2B225D0A632F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery execution installer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Detects executables packed with VMProtect. 4 IoCs

resource	yara_rule
behavioral2/memory/756-0-0x0000000000400000-0x00000000015D3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2320-2-0x0000000000400000-0x00000000015D3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/756-8-0x0000000000400000-0x00000000015D3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2320-107-0x0000000000400000-0x00000000015D3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/756-0-0x0000000000400000-0x00000000015D3000-memory.dmp	UPX
behavioral2/memory/2320-2-0x0000000000400000-0x00000000015D3000-memory.dmp	UPX
behavioral2/memory/756-8-0x0000000000400000-0x00000000015D3000-memory.dmp	UPX
behavioral2/files/0x00030000000002f4-98.dat	UPX
behavioral2/memory/4612-100-0x0000000073E20000-0x0000000073E29000-memory.dmp	UPX
behavioral2/memory/2320-107-0x0000000000400000-0x00000000015D3000-memory.dmp	UPX

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "-"	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCK.exe	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCK.exe\Debugger = "-"	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCK.exe	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00030000000002f4-98.dat	acprotect
behavioral2/memory/4612-100-0x0000000073E20000-0x0000000073E29000-memory.dmp	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
3316	7za.dll
4612	F7E8.tmp

Loads dropped DLL 2 IoCs

pid	Process
4612	F7E8.tmp
4612	F7E8.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	F7E8.tmp

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCK.exe	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4612 set thread context of 4224	4612	F7E8.tmp	100

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/756-0-0x0000000000400000-0x00000000015D3000-memory.dmp	upx
behavioral2/memory/2320-2-0x0000000000400000-0x00000000015D3000-memory.dmp	upx
behavioral2/memory/756-8-0x0000000000400000-0x00000000015D3000-memory.dmp	upx
behavioral2/files/0x00030000000002f4-98.dat	upx
behavioral2/memory/4612-100-0x0000000073E20000-0x0000000073E29000-memory.dmp	upx
behavioral2/memory/2320-107-0x0000000000400000-0x00000000015D3000-memory.dmp	upx

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\360sd\sl2.db	7za.dll
File opened for modification	C:\Program Files (x86)\360\360sd\sl2.db	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\deepscan	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\ipc	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\SoftMgr	7za.dll
File created	C:\Program Files (x86)\360\360safe\SoftMgr\ignorelist.ini	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\SoftMgr\ignorelist.ini	7za.dll
File created	C:\Program Files (x86)\360\360safe\360ss2.dat	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\360ss2.dat	7za.dll
File opened for modification	C:\Program Files (x86)\360\360sd\sl2Plugin.db	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\deepscan\speedmem2.hg	7za.dll
File created	C:\Program Files (x86)\360\360safe\SoftMgr\somextrainfo.ini	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\SoftMgr\somextrainfo.ini	7za.dll
File opened for modification	C:\Program Files (x86)\360\360sd	7za.dll
File created	C:\Program Files (x86)\360\360safe\ipc\kpuaf.dat	7za.dll
File created	C:\Program Files (x86)\360\360safe\deepscan\speedmem2.hg	7za.dll
File opened for modification	C:\Program Files (x86)\360\360safe\ipc\kpuaf.dat	7za.dll
File created	C:\Program Files (x86)\360\360sd\sl2Plugin.db	7za.dll

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4068	cmd.exe
1688	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F7E8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x001000000001c47b-28.dat	nsis_installer_1
behavioral2/files/0x001000000001c47b-28.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MINIE	F7E8.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	F7E8.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE	F7E8.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	F7E8.tmp

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns	F7E8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder	F7E8.tmp

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
756	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
756	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
756	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
756	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
5600	WMIC.exe
5600	WMIC.exe
5600	WMIC.exe
5600	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3316	7za.dll
Token: 35	3316	7za.dll
Token: SeSecurityPrivilege	3316	7za.dll
Token: SeSecurityPrivilege	3316	7za.dll
Token: SeIncreaseQuotaPrivilege	5600	WMIC.exe
Token: SeSecurityPrivilege	5600	WMIC.exe
Token: SeTakeOwnershipPrivilege	5600	WMIC.exe
Token: SeLoadDriverPrivilege	5600	WMIC.exe
Token: SeSystemProfilePrivilege	5600	WMIC.exe
Token: SeSystemtimePrivilege	5600	WMIC.exe
Token: SeProfSingleProcessPrivilege	5600	WMIC.exe
Token: SeIncBasePriorityPrivilege	5600	WMIC.exe
Token: SeCreatePagefilePrivilege	5600	WMIC.exe
Token: SeBackupPrivilege	5600	WMIC.exe
Token: SeRestorePrivilege	5600	WMIC.exe
Token: SeShutdownPrivilege	5600	WMIC.exe
Token: SeDebugPrivilege	5600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5600	WMIC.exe
Token: SeRemoteShutdownPrivilege	5600	WMIC.exe
Token: SeUndockPrivilege	5600	WMIC.exe
Token: SeManageVolumePrivilege	5600	WMIC.exe
Token: 33	5600	WMIC.exe
Token: 34	5600	WMIC.exe
Token: 35	5600	WMIC.exe
Token: 36	5600	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5600	WMIC.exe
Token: SeSecurityPrivilege	5600	WMIC.exe
Token: SeTakeOwnershipPrivilege	5600	WMIC.exe
Token: SeLoadDriverPrivilege	5600	WMIC.exe
Token: SeSystemProfilePrivilege	5600	WMIC.exe
Token: SeSystemtimePrivilege	5600	WMIC.exe
Token: SeProfSingleProcessPrivilege	5600	WMIC.exe
Token: SeIncBasePriorityPrivilege	5600	WMIC.exe
Token: SeCreatePagefilePrivilege	5600	WMIC.exe
Token: SeBackupPrivilege	5600	WMIC.exe
Token: SeRestorePrivilege	5600	WMIC.exe
Token: SeShutdownPrivilege	5600	WMIC.exe
Token: SeDebugPrivilege	5600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5600	WMIC.exe
Token: SeRemoteShutdownPrivilege	5600	WMIC.exe
Token: SeUndockPrivilege	5600	WMIC.exe
Token: SeManageVolumePrivilege	5600	WMIC.exe
Token: 33	5600	WMIC.exe
Token: 34	5600	WMIC.exe
Token: 35	5600	WMIC.exe
Token: 36	5600	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5624	WMIC.exe
Token: SeSecurityPrivilege	5624	WMIC.exe
Token: SeTakeOwnershipPrivilege	5624	WMIC.exe
Token: SeLoadDriverPrivilege	5624	WMIC.exe
Token: SeSystemProfilePrivilege	5624	WMIC.exe
Token: SeSystemtimePrivilege	5624	WMIC.exe
Token: SeProfSingleProcessPrivilege	5624	WMIC.exe
Token: SeIncBasePriorityPrivilege	5624	WMIC.exe
Token: SeCreatePagefilePrivilege	5624	WMIC.exe
Token: SeBackupPrivilege	5624	WMIC.exe
Token: SeRestorePrivilege	5624	WMIC.exe
Token: SeShutdownPrivilege	5624	WMIC.exe
Token: SeDebugPrivilege	5624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5624	WMIC.exe
Token: SeRemoteShutdownPrivilege	5624	WMIC.exe
Token: SeUndockPrivilege	5624	WMIC.exe
Token: SeManageVolumePrivilege	5624	WMIC.exe
Token: 33	5624	WMIC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2320	756	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe	89
PID 2320 wrote to memory of 3316	2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe	90
PID 2320 wrote to memory of 4068	2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe	92
PID 4068 wrote to memory of 5600	4068	cmd.exe	94
PID 2320 wrote to memory of 1688	2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe	96
PID 1688 wrote to memory of 5624	1688	cmd.exe	98
PID 2320 wrote to memory of 4612	2320	2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe	99
PID 4612 wrote to memory of 4224	4612	F7E8.tmp	100
PID 4612 wrote to memory of 4224	4612	F7E8.tmp	100

C:\Users\Admin\AppData\Local\Temp\2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_864b49e68876b5ef57a39c3af913c9c2_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\7za.dll
    "C:\Users\Admin\AppData\Local\Temp\7za.dll" x "C:\Users\Admin\AppData\Local\Temp\360Safe.dll" -o"C:\Program Files (x86)\360" -r -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C WMIC BIOS get Manufacturer
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC BIOS get Manufacturer
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C WMIC BIOS get Manufacturer
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC BIOS get Manufacturer
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\F7E8.tmp
    C:\Users\Admin\AppData\Local\Temp\F7E8.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\system32\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

360Safe.dll

Path C:\Users\Admin\AppData\Local\Temp\360Safe.dll
Size 197KB
SHA256 505162f488334afe73bdba1e8a1922ec84b62a95133f68c1c2f57830ea204912
MD5 7a8eea054b013d75c270b06784fafa70
SHA1 bab072e99a9851000b5c093ba72773c520620949
SHA512 ac7674d2d0899a3548de455b97f328fa7203ae49def2392b06061f59c697b024fbcf50de18c8c6b610d0f397411d13e798315d1d131d5dd651d4e67fc16f5589
SSDEEP 3072:yyVGr4UJH/Kr7YUPASS39EaCHkwfpLKoI7db4csLe3y1TS0y4Wgxwn9cVj4V2:yyVWf0zYS0kkwRKoI9TaS0XWgxBFN
TLSH
T1631413E75497BE79291AC270CE95470FB79DB3520FA860571D3228AE740CD3CA2B94CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.dll

Path C:\Users\Admin\AppData\Local\Temp\7za.dll
Size 637KB
SHA256 e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa
MD5 e3c061fa0450056e30285fd44a74cd2a
SHA1 8c7659e6ee9fe5ead17cae2969d3148730be509b
SHA512 fe7796b4c5aa07c40aa2511a987fed59366d3c27bf7343f126f06cb937bfe7a7d8bd6cd785a7e3dc9087b99973e8542b6da7be6eed4585bd3cee13164aed79b4
SSDEEP 12288:MCEg6ksPgamGycPycplunzCke+tMU0gKVDrnI/Anky3ZDH:MCCks4ECO8zfeJ3rnI/A93F
TLSH
T135D48E1236F6C0BED2720131CA1DABF591FBE7190B2548C36780CE1D2B799D5CA3AA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F7E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\F7E8.tmp
Size 554KB
SHA256 8f9d97f9f7353995122d12bd9bcf98ff1f89c8170126d07904ca8d5dfb8a8b52
MD5 968911dd638b96c185ad0f80d4016740
SHA1 042f255d5cc937a59c907c6794951a84f6062737
SHA512 c326594a9b7f8e911a33f7265cfa7bfd757c87d21e5a6359696a67c5c568b3da38b3630008f56bae98739c957ba6114d244ea351bf9e42c0d840ccc1f3258f39
SSDEEP 12288:5tUzeAZRuOOwPbHPQnuvgtehFYPKWMidYIXbY:5APZBPbvQagtehOR1PE
TLSH
T1BBC423D22820ED52CBB292B6B861FA149FD24B3A9148C7078741FF4779B33534E1ED99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfDel.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbFA99.tmp\SelfDel.dll
Size 5KB
SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
MD5 e5786e8703d651bc8bd4bfecf46d3844
SHA1 fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
SHA512 d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
SSDEEP 96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
TLSH
T1D6B1D785B7DC0A7AE0F747351EB18A26202BFC504EB8D3AD4994214BAC76294C67A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbFA99.tmp\System.dll
Size 11KB
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
TLSH
T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-0-0x0000000000400000-0x00000000015D3000-memory.dmp

Download

memory/756-1-0x0000000001C00000-0x0000000001C01000-memory.dmp

Download

memory/756-8-0x0000000000400000-0x00000000015D3000-memory.dmp

Download

memory/2320-2-0x0000000000400000-0x00000000015D3000-memory.dmp

Download

memory/2320-3-0x00000000033B0000-0x00000000033B1000-memory.dmp

Download

memory/2320-107-0x0000000000400000-0x00000000015D3000-memory.dmp

Download

memory/4612-100-0x0000000073E20000-0x0000000073E29000-memory.dmp

Download