Overview

overview

9

Static

static

3

2026-11-09...at.exe

windows10-2004-x64

9

2026-11-09...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe
  • Size 12.0MB
  • Sample261110-wez76act2x
  • SHA256 acfa400b2349783767e34a39f0e31a381bf07c7deffdd17028c3cb9e1e61552c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Custom signature
    Detects executables built or packed with MPress PE compressor 3 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Blocks application from running via registry modification 1 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 17 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im "IDMan.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build17f.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build17f.exe" /skipdlgs
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4240
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\" -skdlgs
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5184
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1992
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            PID:2916
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            PID:3880
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4564
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:6072
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:5188
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr /onsilentsetup
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4876
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            PID:4072
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:3400
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5492
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:6092
          • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
            "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:364
            • C:\Windows\system32\RUNDLL32.EXE
              "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
              6⤵
              • Adds Run key to start application
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:2276
              • C:\Windows\system32\runonce.exe
                "C:\Windows\system32\runonce.exe" -r
                7⤵
                • Checks processor information in registry
                • Suspicious use of WriteProcessMemory
                PID:6040
                • C:\Windows\System32\grpconv.exe
                  "C:\Windows\System32\grpconv.exe" -o
                  8⤵
                    PID:2300
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4296
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:5376
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2976
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1620
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5344
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:3452
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3236
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:3488
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4680
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:5428
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1504
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:3828
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:796
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  7⤵
                  • Loads dropped DLL
                  PID:3228
      • C:\Windows\SysWOW64\timeout.exe
        "C:\Windows\System32\timeout.exe" /t 3
        2⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:6120
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "IDMan.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:252
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.7.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.7.exe" -silent
        2⤵
        • Blocks application from running via registry modification
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\cscript.exe
          cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:6016
        • C:\Windows\SysWOW64\reg.exe
          reg.exe import C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5628
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c call "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat"
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:896
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ver
            4⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:4724
          • C:\Windows\system32\reg.exe
            reg query "HKCU\Console" /v ForceV2
            4⤵
              PID:5008
            • C:\Windows\system32\find.exe
              find /i "0x0"
              4⤵
                PID:2032
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
                4⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5812
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4780
                • C:\Windows\system32\cmd.exe
                  cmd
                  5⤵
                    PID:2040
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat" "
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3920
                • C:\Windows\system32\find.exe
                  find /i "C:\Users\Admin\AppData\Local\Temp"
                  4⤵
                    PID:2716
                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2648
                  • C:\Windows\system32\find.exe
                    find /i "FullLanguage"
                    4⤵
                      PID:3680
                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1156
                    • C:\Windows\system32\find.exe
                      find /i "computersystem"
                      4⤵
                        PID:4888
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul
                        4⤵
                        • Executes a command shell one-liner
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1324
                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4364
                      • C:\Windows\system32\reg.exe
                        reg query HKU\\Software
                        4⤵
                          PID:2232
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul
                          4⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5660
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3088
                        • C:\Windows\system32\reg.exe
                          reg query HKU\S-1-5-21-650287814-2715975232-1279715623-1000\Software
                          4⤵
                            PID:5948
                          • C:\Windows\system32\reg.exe
                            reg delete HKCU\IAS_TEST /f
                            4⤵
                            • Modifies registry key
                            PID:5984
                          • C:\Windows\system32\reg.exe
                            reg delete HKU\S-1-5-21-650287814-2715975232-1279715623-1000\IAS_TEST /f
                            4⤵
                              PID:1848
                            • C:\Windows\system32\reg.exe
                              reg add HKCU\IAS_TEST
                              4⤵
                              • Modifies registry key
                              PID:2120
                            • C:\Windows\system32\reg.exe
                              reg query HKU\S-1-5-21-650287814-2715975232-1279715623-1000\IAS_TEST
                              4⤵
                                PID:3172
                              • C:\Windows\system32\reg.exe
                                reg delete HKCU\IAS_TEST /f
                                4⤵
                                • Modifies registry key
                                PID:6132
                              • C:\Windows\system32\reg.exe
                                reg delete HKU\S-1-5-21-650287814-2715975232-1279715623-1000\IAS_TEST /f
                                4⤵
                                  PID:3044
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
                                  4⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3204
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
                                    5⤵
                                      PID:3128
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-650287814-2715975232-1279715623-1000\Software\DownloadManager" /v ExePath 2>nul
                                    4⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3904
                                    • C:\Windows\system32\reg.exe
                                      reg query "HKU\S-1-5-21-650287814-2715975232-1279715623-1000\Software\DownloadManager" /v ExePath
                                      5⤵
                                        PID:3684
                                    • C:\Windows\system32\reg.exe
                                      reg add HKU\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
                                      4⤵
                                        PID:3160
                                      • C:\Windows\system32\reg.exe
                                        reg query HKU\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
                                        4⤵
                                          PID:4748
                                        • C:\Windows\system32\reg.exe
                                          reg delete HKU\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f
                                          4⤵
                                            PID:4568
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
                                            4⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:3692
                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
                                              5⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4608
                                          • C:\Windows\system32\reg.exe
                                            reg export HKCU\Software\Classes\Wow6432Node\CLSID "C:\Windows\Temp\_Backup_HKCU_CLSID_20261110-175107335.reg"
                                            4⤵
                                              PID:4392
                                            • C:\Windows\system32\reg.exe
                                              reg query "HKCU\Software\DownloadManager" "/v" "Email"
                                              4⤵
                                                PID:2196
                                              • C:\Windows\system32\reg.exe
                                                reg query "HKCU\Software\DownloadManager" "/v" "Serial"
                                                4⤵
                                                  PID:3284
                                                • C:\Windows\system32\reg.exe
                                                  reg query "HKCU\Software\DownloadManager" "/v" "scansk"
                                                  4⤵
                                                    PID:1828
                                                  • C:\Windows\system32\reg.exe
                                                    reg query "HKCU\Software\DownloadManager" "/v" "tvfrdt"
                                                    4⤵
                                                      PID:3664
                                                    • C:\Windows\system32\reg.exe
                                                      reg query "HKCU\Software\DownloadManager" "/v" "radxcnt"
                                                      4⤵
                                                        PID:5648
                                                      • C:\Windows\system32\reg.exe
                                                        reg query "HKCU\Software\DownloadManager" "/v" "LstCheck"
                                                        4⤵
                                                          PID:4652
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"
                                                          4⤵
                                                            PID:5792
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"
                                                            4⤵
                                                              PID:5544
                                                            • C:\Windows\system32\reg.exe
                                                              reg query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"
                                                              4⤵
                                                                PID:5460
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /f
                                                                4⤵
                                                                  PID:1136
                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell.exe "$sid = 'S-1-5-21-650287814-2715975232-1279715623-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5316
                                                                • C:\Windows\system32\chcp.com
                                                                  chcp 65001
                                                                  4⤵
                                                                    PID:2148
                                                                  • C:\Windows\system32\reg.exe
                                                                    REG ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
                                                                    4⤵
                                                                      PID:5708
                                                                    • C:\Windows\system32\reg.exe
                                                                      REG ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
                                                                      4⤵
                                                                        PID:5008
                                                                      • C:\Windows\system32\reg.exe
                                                                        REG ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f
                                                                        4⤵
                                                                          PID:2600
                                                                        • C:\Windows\system32\reg.exe
                                                                          REG ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f
                                                                          4⤵
                                                                            PID:2012
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "Admin" /f
                                                                            4⤵
                                                                              PID:2292
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
                                                                            3⤵
                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1444
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "TipStartUp" /t REG_DWORD /d "1" /f
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2604
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "FName" /t REG_SZ /d "Catz Friends" /f
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5192
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\DownloadManager" /v "LName" /t REG_SZ /d " " /f
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1892
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ed33f381-fb75-0c40-9dcb-12d927859b30}\idmwfp.inf" "9" "4fc2928b3" "0000000000000168" "WinSta0\Default" "00000000000000E0" "208" "C:\Program Files (x86)\Internet Download Manager"
                                                                        1⤵
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:6000
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000198" "WinSta0\Default"
                                                                        1⤵
                                                                        • Drops file in Drivers directory
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5312
                                                                      • C:\Windows\system32\grpconv.exe
                                                                        grpconv -o
                                                                        1⤵
                                                                          PID:6124

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Reconnaissance

                                                                              Resource Development

                                                                              Initial Access

                                                                              Execution

                                                                              Command and Scripting Interpreter

                                                                              3
                                                                              T1059

                                                                              PowerShell

                                                                              1
                                                                              T1059.001

                                                                              Visual Basic

                                                                              1
                                                                              T1059.005

                                                                              Windows Command Shell

                                                                              1
                                                                              T1059.003

                                                                              Persistence

                                                                              Boot or Logon Autostart Execution

                                                                              1
                                                                              T1547

                                                                              Registry Run Keys / Startup Folder

                                                                              1
                                                                              T1547.001

                                                                              Browser Extensions

                                                                              1
                                                                              T1176

                                                                              Event Triggered Execution

                                                                              1
                                                                              T1546

                                                                              Component Object Model Hijacking

                                                                              1
                                                                              T1546.015

                                                                              Privilege Escalation

                                                                              Boot or Logon Autostart Execution

                                                                              1
                                                                              T1547

                                                                              Registry Run Keys / Startup Folder

                                                                              1
                                                                              T1547.001

                                                                              Event Triggered Execution

                                                                              1
                                                                              T1546

                                                                              Component Object Model Hijacking

                                                                              1
                                                                              T1546.015

                                                                              Defense Evasion

                                                                              Modify Registry

                                                                              4
                                                                              T1112

                                                                              Credential Access

                                                                              Credentials from Password Stores

                                                                              1
                                                                              T1555

                                                                              Credentials from Web Browsers

                                                                              1
                                                                              T1555.003

                                                                              Unsecured Credentials

                                                                              1
                                                                              T1552

                                                                              Credentials In Files

                                                                              1
                                                                              T1552.001

                                                                              Discovery

                                                                              Peripheral Device Discovery

                                                                              1
                                                                              T1120

                                                                              Query Registry

                                                                              3
                                                                              T1012

                                                                              System Information Discovery

                                                                              3
                                                                              T1082

                                                                              System Location Discovery

                                                                              1
                                                                              T1614

                                                                              System Language Discovery

                                                                              1
                                                                              T1614.001

                                                                              System Network Configuration Discovery

                                                                              1
                                                                              T1016

                                                                              Lateral Movement

                                                                              Collection

                                                                              Data from Local System

                                                                              1
                                                                              T1005

                                                                              Command and Control

                                                                              Exfiltration

                                                                              Impact

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              IDMGetAll.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                                                                              • Size 73KB
                                                                              • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMGetAll64.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                                                                              • Size 93KB
                                                                              • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMIECC.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                                                                              • Size 463KB
                                                                              • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMIECC64.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                                                                              • Size 656KB
                                                                              • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMNetMon64.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                                                                              • Size 572KB
                                                                              • SHA256 629ae3c80dd0640011f8745af9756a19c16ba5e4921028b21f92a0cc1928e8a9
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMShellExt64.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                                                                              • Size 36KB
                                                                              • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMan.exe
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                              • Size 6.2MB
                                                                              • SHA256 9a26f61345aa152fd28c1d63da368354698c7ab09d2826eb69782b86c01563c9
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              downlWithIDM.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                                                                              • Size 197KB
                                                                              • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              downlWithIDM64.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                                                                              • Size 155KB
                                                                              • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idmBroker.exe
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                                                                              • Size 153KB
                                                                              • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idmfsa.dll
                                                                              • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                                                                              • Size 90KB
                                                                              • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              StartupProfileData-NonInteractive
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              • Size 1KB
                                                                              • SHA256 10be5871854110c66a3072017558ed2496495c1eaa20425f67156d683e154942
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              StartupProfileData-NonInteractive
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              • Size 1KB
                                                                              • SHA256 12011b3f0e93f81bc93d4c84fbc3ab738c0a39b4efc7ee9c7e37f20c49a6b399
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              StartupProfileData-NonInteractive
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              • Size 1KB
                                                                              • SHA256 aef8b020212d19e8c6e52e5f91f96126439e9399bc7e0a9ef369ab991df7b2fa
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              StartupProfileData-NonInteractive
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              • Size 1KB
                                                                              • SHA256 c3450f7fcf7deacd684aff39e3cfe0c63ad7630478796a7448b47d317098a242
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              StartupProfileData-NonInteractive
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              • Size 1KB
                                                                              • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              BATCLEN.bat
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BATCLEN.bat
                                                                              • Size 19KB
                                                                              • SHA256 12b47c1949cc555c2f68f9fd4677ed5266f25c4da4630bec36e303629b133225
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMRegClean.reg
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IDMRegClean.reg
                                                                              • Size 5KB
                                                                              • SHA256 4c0e2396b9fca1bbeb36e9ebb27f27e63cd2662abf8b18f042d872322e1363eb
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDM1.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                                                                              • Size 163KB
                                                                              • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDMSetup2.log
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                              • Size 3KB
                                                                              • SHA256 c9a75d2f6a98076c64a823a33bc6e92960f4a54e207505594781d8f35c539f76
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              IDMSetup2.log
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                              • Size 3KB
                                                                              • SHA256 c6b4eed0cc8f2898a89aa0c00e386c5285e408aa228c2bc0bd5397d49b86618a
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              IDMSetup2.log
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                              • Size 4KB
                                                                              • SHA256 2a15c9016d94450381ce04646eb7407bdcff3f0435ad3d079d1c7308b6ced65b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              REG66BF.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\REG66BF.tmp
                                                                              • Size 26KB
                                                                              • SHA256 9f85e0e71de8dc2c3b37b137b6a50d51b596ca6b7d4f2fd8bf45fae561371e7f
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              IDM_6.4x_Crack_v20.7.exe
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDM_6.4x_Crack_v20.7.exe
                                                                              • Size 55KB
                                                                              • SHA256 8eaa420d3c8e7aa450d79f8635c2de5c8f8038a3d3ee3775a3cb7e411d2181fc
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idman643build17f.exe
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\idman643build17f.exe
                                                                              • Size 11.6MB
                                                                              • SHA256 88a73ebf8ee12538a35430878cb786d2e257c980c293a532b2222d08fd593b62
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              WININF.vbs
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
                                                                              • Size 2KB
                                                                              • SHA256 f4a33112450eba45ee2738001352e3af5e977194610a127ee4a8feef4c44568e
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              __PSScriptPolicyTest_p0r1rt5q.i40.ps1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0r1rt5q.i40.ps1
                                                                              • Size 60B
                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              idmwfp.cat
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\{ed33f381-fb75-0c40-9dcb-12d927859b30}\idmwfp.cat
                                                                              • Size 13KB
                                                                              • SHA256 36dd39268ac667c3e6600914a62bcdabcef930e50863f1193ea92c6fc9908a8e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idmwfp.inf
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\{ed33f381-fb75-0c40-9dcb-12d927859b30}\idmwfp.inf
                                                                              • Size 2KB
                                                                              • SHA256 375b63ff4a9d37cbb9751415a735237d4c1a5b8619503e5805217d54b856f1f8
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              idmwfp64.sys
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\{ed33f381-fb75-0c40-9dcb-12d927859b30}\idmwfp64.sys
                                                                              • Size 182KB
                                                                              • SHA256 8acffb0181146e96c44a94c5b364d657b775936ebb4d0fcce591068f74803c4a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idmcchandler2.dll
                                                                              • Path C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll
                                                                              • Size 326KB
                                                                              • SHA256 1450146b904919474ef6d528b20a672a33a32afc4a1e40f69d515b523d72fa19
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idmcchandler2_64.dll
                                                                              • Path C:\Users\Admin\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll
                                                                              • Size 451KB
                                                                              • SHA256 59ac02f5a0644bf56b7ad7e2b48fc8f89083f8cfe12a0a93f63163a5573a876f
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              idmwfp.inf_amd64_be5722ccff6c2371.ini
                                                                              • Path C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371.ini
                                                                              • Size 415B
                                                                              • SHA256 1ba31e7c907190d2a6784d5bbe5741dec7f4562ac7081be4330aeeec32a8880e
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              memory/364-629-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                              Download

                                                                              memory/2028-524-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                              Download

                                                                              memory/2028-645-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                              Download

                                                                              memory/2648-594-0x000002AB443B0000-0x000002AB443D2000-memory.dmp
                                                                              Download

                                                                              memory/5184-13-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                              Download

                                                                              memory/5184-455-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                              Download