xbinder | e045393a6a54dab9fae98783243072345d8551062caabf4a28c728682c262a3d

Analysis

user interaction
yes
max time kernel
140s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/11/2026, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput.exe
Size 3.9MB
Sample261115-bkpcmax15m
SHA256 e045393a6a54dab9fae98783243072345d8551062caabf4a28c728682c262a3d
MD5 0296487644e24c3c45e291278ed9c36c
SHA1 ca98a151926660e96566c2bfe474d7c92a6a64f3
SHA512 b1d93d1ea7a1ce21886bdcf5116cf29a4e9d0725e1970e46c93340b8111e70300cd0efe1a0f021a22d5d9ff7b0c3299222cf43a454501bf34f544a19f60eb6cc
SSDEEP 98304:BPPaqMgRa1dZbJUBYjCDsjj3eHMZyTjvbDyA7xqwobO2v6/D:5jR+nJvMq2jXyqxqwq36/
TLSH
T155163388F207D61EC4A9E332DE436C219190775BFE15EE1BDA1E69BE9A406B03D15B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution xbinder loader persistence

Malware Config

Extracted

Family

xbinder

Mutex

e8gX9ChiETTm3X2eS

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
z3ama.mp3
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
Ittihad.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Manipulates Digital Signatures 1 TTPs 17 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
3516	Ittihad.exe
4144	tagtbq.exe
5648	ctrjrj.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ctrjrj.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
3568	powershell.exe
3912	powershell.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\lsass.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\smss.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\dwm.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\advapi32.dll	ctrjrj.exe
File opened for modification	C:\Windows\System32\shell32.dll	ctrjrj.exe
File opened for modification	C:\Windows\System32\ntdll.dll	ctrjrj.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\services.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\csrss.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\wininit.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\svchost.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\dllhost.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\spoolsv.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\kernel32.dll	ctrjrj.exe
File opened for modification	C:\Windows\System32\user32.dll	ctrjrj.exe
File opened for modification	C:\Windows\System32\winlogon.exe	ctrjrj.exe
File opened for modification	C:\Windows\System32\gdi32.dll	ctrjrj.exe
File opened for modification	C:\Windows\System32\ole32.dll	ctrjrj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2992	cmd.exe
2884	cmd.exe
5988	cmd.exe
3232	cmd.exe
5816	cmd.exe
2684	cmd.exe
4684	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Ittihad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Ittihad.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ittihad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\HubOnSound	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000104	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.System.NearShareExperienceReceive	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.NfpAppAcquire	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\DeviceFail	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\SoundSentry	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Keyboard Layout	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Preference	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.Print.Notification	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Blind Access	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000201	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.System.ShareExperience	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.StartupApp	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Printers\DevModePerUser	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02dmzaqnudvjubgn	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\DeviceConnect	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Microsoft.Windows.InputSwitchToastHandler	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.BackgroundAccess	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore\Parents	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\CCSelect	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE40.UserAgent	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	XBinderOutput.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5340	reg.exe
1140	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5280	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3568	powershell.exe
3568	powershell.exe
3516	Ittihad.exe
3912	powershell.exe
3912	powershell.exe
3516	Ittihad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5280	vlc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	Ittihad.exe
Token: SeDebugPrivilege	3516	Ittihad.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: 33	4764	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4764	AUDIODG.EXE
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	5648	ctrjrj.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe
5280	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5280	vlc.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 5280	5824	XBinderOutput.exe	80
PID 5824 wrote to memory of 3516	5824	XBinderOutput.exe	81
PID 3516 wrote to memory of 4684	3516	Ittihad.exe	83
PID 4684 wrote to memory of 3568	4684	cmd.exe	85
PID 3568 wrote to memory of 4144	3568	powershell.exe	86
PID 3516 wrote to memory of 2992	3516	Ittihad.exe	88
PID 2992 wrote to memory of 3912	2992	cmd.exe	90
PID 3912 wrote to memory of 5648	3912	powershell.exe	91
PID 5648 wrote to memory of 2884	5648	ctrjrj.exe	92
PID 5648 wrote to memory of 5988	5648	ctrjrj.exe	94
PID 5648 wrote to memory of 3232	5648	ctrjrj.exe	96
PID 5648 wrote to memory of 5816	5648	ctrjrj.exe	98
PID 5648 wrote to memory of 2684	5648	ctrjrj.exe	100
PID 5816 wrote to memory of 2876	5816	cmd.exe	102
PID 2684 wrote to memory of 4584	2684	cmd.exe	103
PID 5988 wrote to memory of 5340	5988	cmd.exe	104
PID 2884 wrote to memory of 780	2884	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\z3ama.mp3"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5280
- C:\Users\Admin\AppData\Local\Temp\Ittihad.exe
  "C:\Users\Admin\AppData\Local\Temp\Ittihad.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tagtbq.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tagtbq.exe"'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\tagtbq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tagtbq.exe"
        5⤵
        Executes dropped EXE
        
        PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ctrjrj.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ctrjrj.exe"'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\ctrjrj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ctrjrj.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5648
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        7⤵
        
        PID:780
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKCU /f
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5988
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCU /f
        7⤵
        Modifies registry key
        
        PID:5340
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKLM /f
        6⤵
        Executes a command shell one-liner
        
        PID:3232
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM /f
        7⤵
        Modifies registry key
        
        PID:1140
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKU /f
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Windows\system32\reg.exe
        
        reg delete HKU /f
        7⤵
        Manipulates Digital Signatures
        Modifies data under HKEY_USERS
        
        PID:2876
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKCC /f
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCC /f
        7⤵
        
        PID:4584

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09
MD5 faa2dd409bb88491b6c57728dbf8a673
SHA1 6095f074030e7599cb1f9c251c62e2c0d1fb7418
SHA512 0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce
TLSH
T1DB4159303121B5D80D435F5608286EC9A2FF474ABFAC9F5CB669221DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 da3f7bc0fa2fc2a6c2fffe02807682e353217f45abf41fbbea775dc3ceca3dd8
MD5 fc416d44a54d6399db99bb42d499e55b
SHA1 cfd880be9eb869763122472b7e4a74f161cbabba
SHA512 f13164e996a3569bd1f69407e8128f714f0c269739e21e1a6c94b11f8367cb22fd0e8c8c469a6558ffd7c17360e20f8720cc5fe0988c32e16f78c469ed2b8f5c
SSDEEP 384:LMHYOLS1+VWs5xjPFR6kpzSHnnNfjs2gtgqNrKY59c9zd:oLSWWiHRLzSNfj7gtg6rKqc9zd
TLSH
T10862B4AE720F22C7C8D51374D10A054FE4F2DECD031E13D9B72A9E3B8AECA5E5168599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ittihad.exe

Path C:\Users\Admin\AppData\Local\Temp\Ittihad.exe
Size 64KB
SHA256 bce6f4d27dcc20d837fd8cd48a9c068371e0cd33b5b585f5048197fb837c101e
MD5 bea0a8d54d6fe58ce5702b3dbcb4eff0
SHA1 4c1fa51c9e9ca3114875792007c35f64ba1acf7d
SHA512 43493afde4c4e9681ca7f10a74d2d13fe02e6d9cf6642724a40cbc08933177fde05e5374305b8be544a22baba32536bfc8edd503a0065299e0d23d6efd9dd412
SSDEEP 1536:kBSY7RpR4WcgaZwjlYFnKMzZgpBLW3PP6hbyXlACqJlRwzVmx:kBSqDOhZw0lGJUP6hbyjqJWmx
TLSH
T1A453F608A6ACD51EF6BEDBB744E0BFA153FEB1231B07C5CA59D4839D3232BC18611598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kajjar0r.u3o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kajjar0r.u3o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ctrjrj.exe

Path C:\Users\Admin\AppData\Local\Temp\ctrjrj.exe
Size 11KB
SHA256 48f7f4568b1480c9ca31ab5fcc7b83041c01c363fcb78b0f09ce96b768ec542f
MD5 6934f3cf12d75d4f40a0e797a0594819
SHA1 f2f7a93159ae583b3be35c9eaf28f4d77ca450d1
SHA512 914c8f3873904ea24e80c78d5e623feebe18b77d5e1230bc09c22d774136b4af87d1eb8573873b60562ca102d832eece66f11d39da3e61e28689aea57b34c137
SSDEEP 192:zUdQooWELGakAoUONuo2GvH0l7X0n2E49w6oqruj3cq:oxoWEDJoU8uevH0FX+2j93aI
TLSH
T14A32C64DA3D98625D1FD4B3628B7E21087B0F0138A2BCB5E1DE998FD2D337106966B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tagtbq.exe

Path C:\Users\Admin\AppData\Local\Temp\tagtbq.exe
Size 583KB
SHA256 d88f5b00da5f05ab7f55fd7c414bb56aaf47e9f51365aaabd71f3ace3cc77523
MD5 320b1115164e8b5e1316d86eb29cd299
SHA1 bc046d8b14359a7a2bebdecbb819e76c47d84d1b
SHA512 fab558cf31aa79caf8e4f6e5649e4e484de3e29bae1386aa61749b70e8c791d74b01fa964501d4755c7688d0420e932f30e36699a2fe4488fae82ee23558afd0
SSDEEP 12288:Y7ogwYqbE3DMuR6BlTTnn9ZOKp0Ac9fEmtdyaukNU9ad:1gIcou0Tnnjr2fEmDNh
TLSH
T122C4BE67F1050E32C889933E5463A73153204C19FFA70B1466D8FD686ACF6F86769BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z3ama.mp3

Path C:\Users\Admin\AppData\Local\Temp\z3ama.mp3
Size 3.9MB
SHA256 1e13a5951874428c89b948cef2650972d8ddaa20786b2872bbaa219a39ce00ae
MD5 abc6b472b96ad7188bc883bd5a0fb681
SHA1 78b0744a57de71d75d70e82347372057f1592daa
SHA512 1bc0b6774a6bee38d5852d15becf699221505c1de80c482843739893481a5e9e2d9823882d64b1f3652fdfcbce5b135ef2a536e5b1658d5e393125750d4c2ef8
SSDEEP 98304:g3yHW/SkBu0FQjaZbUukZrOLbflrvmeIKXdn:g3yHCSkM0q+ZbJGrml7ttXdn
TLSH
T10416330297F6776FF8D882720AAB75206F232C65EF19B6E93711BB7584F10B57930A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 82B
SHA256 66104d2db193776a2f540cc096c7570ec58ef1f9f41a135e59e7326fc001cb40
MD5 8d729e54f135551f25a95bec4cd5cee7
SHA1 f3047a407cfed0063b9b6947c1d37c0d0e1cb968
SHA512 57cd122d84b03ef806ea1f99facf509ce3735ecd7234f613b17f87bb2a149bde6360f905a3cbdf4c1f45e68f70489aae6eb2b79e837f0494e66ea0daf4823db4
TLSH
T1A5A012008085522BD68444D31198410E0021E405404872909B67A0052010C5F32C0634
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3516-28-0x0000000005200000-0x0000000005266000-memory.dmp

Download

memory/3516-29-0x00000000056C0000-0x000000000575C000-memory.dmp

Download

memory/3516-32-0x0000000006640000-0x0000000006BE6000-memory.dmp

Download

memory/3516-105-0x0000000006EB0000-0x0000000006F26000-memory.dmp

Download

memory/3516-107-0x0000000006E50000-0x0000000006E6E000-memory.dmp

Download

memory/3516-108-0x0000000007190000-0x0000000007222000-memory.dmp

Download

memory/3516-109-0x0000000006D00000-0x0000000006D0A000-memory.dmp

Download

memory/3516-230-0x00000000074B0000-0x00000000074BC000-memory.dmp

Download

memory/3516-22-0x00000000008F0000-0x0000000000906000-memory.dmp

Download

memory/3516-106-0x0000000006610000-0x000000000661C000-memory.dmp

Download

memory/3568-259-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/3568-256-0x00000000052D0000-0x0000000005306000-memory.dmp

Download

memory/3568-269-0x0000000007950000-0x00000000079E6000-memory.dmp

Download

memory/3568-268-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/3568-267-0x00000000066A0000-0x00000000066BE000-memory.dmp

Download

memory/3568-266-0x0000000006320000-0x0000000006677000-memory.dmp

Download

memory/3568-271-0x0000000006D00000-0x0000000006D22000-memory.dmp

Download

memory/3568-270-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

Download

memory/3568-258-0x00000000058D0000-0x00000000058F2000-memory.dmp

Download

memory/3568-257-0x00000000059E0000-0x000000000600A000-memory.dmp

Download

memory/3912-332-0x0000000005B40000-0x0000000005E97000-memory.dmp

Download

memory/4144-276-0x000000001B340000-0x000000001B3E6000-memory.dmp

Download

memory/4144-277-0x000000001B9F0000-0x000000001BEBE000-memory.dmp

Download

memory/4144-278-0x000000001BEC0000-0x000000001BF5C000-memory.dmp

Download

memory/4144-279-0x0000000000C40000-0x0000000000C48000-memory.dmp

Download

memory/4144-280-0x000000001C020000-0x000000001C06C000-memory.dmp

Download

memory/5280-35-0x00007FF8AB6E0000-0x00007FF8AB996000-memory.dmp

Download

memory/5280-38-0x00007FF8C3C30000-0x00007FF8C3C41000-memory.dmp

Download

memory/5280-93-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-46-0x00007FF8BF520000-0x00007FF8BF541000-memory.dmp

Download

memory/5280-47-0x00007FF8BFC70000-0x00007FF8BFC88000-memory.dmp

Download

memory/5280-48-0x00007FF8BF6B0000-0x00007FF8BF6C1000-memory.dmp

Download

memory/5280-49-0x00007FF8BF500000-0x00007FF8BF511000-memory.dmp

Download

memory/5280-50-0x00007FF8BF4E0000-0x00007FF8BF4F1000-memory.dmp

Download

memory/5280-122-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-146-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-170-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-194-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-218-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-51-0x00007FF8BF440000-0x00007FF8BF45B000-memory.dmp

Download

memory/5280-243-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-52-0x00007FF8BEF10000-0x00007FF8BEF21000-memory.dmp

Download

memory/5280-45-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-53-0x00007FF8BEEF0000-0x00007FF8BEF08000-memory.dmp

Download

memory/5280-54-0x00007FF8BEEC0000-0x00007FF8BEEF0000-memory.dmp

Download

memory/5280-55-0x00007FF8B6D60000-0x00007FF8B6DC7000-memory.dmp

Download

memory/5280-56-0x00007FF8B5B00000-0x00007FF8B5B7C000-memory.dmp

Download

memory/5280-69-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-40-0x00007FF8C3B90000-0x00007FF8C3BA1000-memory.dmp

Download

memory/5280-36-0x00007FF8C8E40000-0x00007FF8C8E58000-memory.dmp

Download

memory/5280-37-0x00007FF8C7E20000-0x00007FF8C7E37000-memory.dmp

Download

memory/5280-359-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-39-0x00007FF8C3BB0000-0x00007FF8C3BC7000-memory.dmp

Download

memory/5280-42-0x00007FF8C3510000-0x00007FF8C3521000-memory.dmp

Download

memory/5280-44-0x00007FF8BF550000-0x00007FF8BF591000-memory.dmp

Download

memory/5280-43-0x00007FF8B3A40000-0x00007FF8B3C4B000-memory.dmp

Download

memory/5280-41-0x00007FF8C3B70000-0x00007FF8C3B8D000-memory.dmp

Download

memory/5280-34-0x00007FF8C3B20000-0x00007FF8C3B54000-memory.dmp

Download

memory/5280-294-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-308-0x00007FF8AB6E0000-0x00007FF8AB996000-memory.dmp

Download

memory/5280-318-0x000002779F200000-0x00000277A02B0000-memory.dmp

Download

memory/5280-33-0x00007FF6A5760000-0x00007FF6A5858000-memory.dmp

Download

memory/5280-19-0x00007FF8AB6E0000-0x00007FF8AB996000-memory.dmp

Download

memory/5280-8-0x00007FF8AB98D000-0x00007FF8AB98F000-memory.dmp

Download

memory/5648-343-0x00000000002D0000-0x00000000002DA000-memory.dmp

Download

memory/5824-1-0x000000001B2A0000-0x000000001B2B0000-memory.dmp

Download

memory/5824-0-0x0000000000280000-0x0000000000678000-memory.dmp

Download