16486dce457024bb3150bb232e5a766773be563448b9bcd2b6bc3b0e96b9adf0

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 43.4MB
Sample260423-ffkwvsa191
SHA256 16486dce457024bb3150bb232e5a766773be563448b9bcd2b6bc3b0e96b9adf0
MD5 6c97a1c7bb0dd01841e4acafe2b5b9a2
SHA1 54185f5f54f3a08b25a4d2bfab3e6152c7bb1f2f
SHA512 085c7a8ef058ecc1269f9b9356454f0ed49eabd7b643a2e61631de31eb1a11faf506ffc2507adf0d2a58630643567711ab7d6f7419e315ca550accbf3b302b84
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfD:fMguj8Q4VfvnqFTrYi
TLSH
T1B4A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4416	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1376	powershell.exe
4680	powershell.exe
4060	powershell.exe
4352	powershell.exe
4124	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1916	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4148	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2528	systeminfo.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4720	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1376	powershell.exe
4060	powershell.exe
1376	powershell.exe
4060	powershell.exe
4352	powershell.exe
4352	powershell.exe
4124	powershell.exe
4124	powershell.exe
4680	powershell.exe
4680	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeIncreaseQuotaPrivilege	1344	WMIC.exe
Token: SeSecurityPrivilege	1344	WMIC.exe
Token: SeTakeOwnershipPrivilege	1344	WMIC.exe
Token: SeLoadDriverPrivilege	1344	WMIC.exe
Token: SeSystemProfilePrivilege	1344	WMIC.exe
Token: SeSystemtimePrivilege	1344	WMIC.exe
Token: SeProfSingleProcessPrivilege	1344	WMIC.exe
Token: SeIncBasePriorityPrivilege	1344	WMIC.exe
Token: SeCreatePagefilePrivilege	1344	WMIC.exe
Token: SeBackupPrivilege	1344	WMIC.exe
Token: SeRestorePrivilege	1344	WMIC.exe
Token: SeShutdownPrivilege	1344	WMIC.exe
Token: SeDebugPrivilege	1344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1344	WMIC.exe
Token: SeRemoteShutdownPrivilege	1344	WMIC.exe
Token: SeUndockPrivilege	1344	WMIC.exe
Token: SeManageVolumePrivilege	1344	WMIC.exe
Token: 33	1344	WMIC.exe
Token: 34	1344	WMIC.exe
Token: 35	1344	WMIC.exe
Token: 36	1344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1344	WMIC.exe
Token: SeSecurityPrivilege	1344	WMIC.exe
Token: SeTakeOwnershipPrivilege	1344	WMIC.exe
Token: SeLoadDriverPrivilege	1344	WMIC.exe
Token: SeSystemProfilePrivilege	1344	WMIC.exe
Token: SeSystemtimePrivilege	1344	WMIC.exe
Token: SeProfSingleProcessPrivilege	1344	WMIC.exe
Token: SeIncBasePriorityPrivilege	1344	WMIC.exe
Token: SeCreatePagefilePrivilege	1344	WMIC.exe
Token: SeBackupPrivilege	1344	WMIC.exe
Token: SeRestorePrivilege	1344	WMIC.exe
Token: SeShutdownPrivilege	1344	WMIC.exe
Token: SeDebugPrivilege	1344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1344	WMIC.exe
Token: SeRemoteShutdownPrivilege	1344	WMIC.exe
Token: SeUndockPrivilege	1344	WMIC.exe
Token: SeManageVolumePrivilege	1344	WMIC.exe
Token: 33	1344	WMIC.exe
Token: 34	1344	WMIC.exe
Token: 35	1344	WMIC.exe
Token: 36	1344	WMIC.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeIncreaseQuotaPrivilege	4352	powershell.exe
Token: SeSecurityPrivilege	4352	powershell.exe
Token: SeTakeOwnershipPrivilege	4352	powershell.exe
Token: SeLoadDriverPrivilege	4352	powershell.exe
Token: SeSystemProfilePrivilege	4352	powershell.exe
Token: SeSystemtimePrivilege	4352	powershell.exe
Token: SeProfSingleProcessPrivilege	4352	powershell.exe
Token: SeIncBasePriorityPrivilege	4352	powershell.exe
Token: SeCreatePagefilePrivilege	4352	powershell.exe
Token: SeBackupPrivilege	4352	powershell.exe
Token: SeRestorePrivilege	4352	powershell.exe
Token: SeShutdownPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeSystemEnvironmentPrivilege	4352	powershell.exe
Token: SeRemoteShutdownPrivilege	4352	powershell.exe
Token: SeUndockPrivilege	4352	powershell.exe
Token: SeManageVolumePrivilege	4352	powershell.exe
Token: 33	4352	powershell.exe
Token: 34	4352	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4368	3336	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	86
PID 4368 wrote to memory of 4804	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	87
PID 4368 wrote to memory of 4128	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	88
PID 4128 wrote to memory of 4060	4128	cmd.exe	91
PID 4804 wrote to memory of 1376	4804	cmd.exe	92
PID 4060 wrote to memory of 3816	4060	powershell.exe	93
PID 4368 wrote to memory of 2644	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	94
PID 2644 wrote to memory of 3708	2644	cmd.exe	96
PID 3708 wrote to memory of 4976	3708	net.exe	97
PID 4368 wrote to memory of 5000	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	98
PID 5000 wrote to memory of 4416	5000	cmd.exe	100
PID 4368 wrote to memory of 5036	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	101
PID 5036 wrote to memory of 1344	5036	cmd.exe	103
PID 4368 wrote to memory of 4796	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	104
PID 4796 wrote to memory of 4720	4796	cmd.exe	106
PID 4368 wrote to memory of 1252	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	107
PID 1252 wrote to memory of 4148	1252	cmd.exe	109
PID 4368 wrote to memory of 224	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	110
PID 4368 wrote to memory of 1932	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	112
PID 1932 wrote to memory of 4352	1932	cmd.exe	114
PID 224 wrote to memory of 2528	224	cmd.exe	115
PID 4368 wrote to memory of 1652	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	117
PID 1652 wrote to memory of 4124	1652	cmd.exe	119
PID 4368 wrote to memory of 1492	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	120
PID 1492 wrote to memory of 4680	1492	cmd.exe	123
PID 4368 wrote to memory of 1472	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	124
PID 1472 wrote to memory of 1916	1472	cmd.exe	126
PID 4368 wrote to memory of 3728	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	127
PID 3728 wrote to memory of 5072	3728	cmd.exe	129
PID 4368 wrote to memory of 3988	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	130
PID 3988 wrote to memory of 4980	3988	cmd.exe	132
PID 4368 wrote to memory of 396	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	133
PID 396 wrote to memory of 456	396	cmd.exe	135
PID 4368 wrote to memory of 2308	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	136
PID 2308 wrote to memory of 3044	2308	cmd.exe	138
PID 4368 wrote to memory of 3284	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	139
PID 3284 wrote to memory of 2800	3284	cmd.exe	141
PID 4368 wrote to memory of 4376	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	142
PID 4376 wrote to memory of 3816	4376	cmd.exe	144
PID 4368 wrote to memory of 892	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	145
PID 892 wrote to memory of 540	892	cmd.exe	147
PID 4368 wrote to memory of 3884	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	148
PID 3884 wrote to memory of 452	3884	cmd.exe	150
PID 4368 wrote to memory of 3184	4368	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	151
PID 3184 wrote to memory of 4280	3184	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe "C:\snapshot\Kynix Dualhook Bot\builds\b1e4c90b\kynix.js" --hidden
  2⤵
  - Checks computer location settings
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command "Add-Type -Name "Window" -Namespace "Console" -MemberDefinition "[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);"; [Console.Window]::ShowWindow((Get-Process -Id $pid).MainWindowHandle, 0)""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Add-Type -Name "Window" -Namespace "Console" -MemberDefinition "[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);"; [Console.Window]::ShowWindow((Get-Process -Id $pid).MainWindowHandle, 0)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport("Kernel32.dll")]public static extern IntPtr GetConsoleWindow();[DllImport("User32.dll")]public static extern bool ShowWindow(IntPtr hWnd,int nCmdShow);';$w=[C.W]::GetConsoleWindow();[C.W]::ShowWindow($w,0)""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport("Kernel32.dll")]public static extern IntPtr GetConsoleWindow();[DllImport("User32.dll")]public static extern bool ShowWindow(IntPtr hWnd,int nCmdShow);';$w=[C.W]::GetConsoleWindow();[C.W]::ShowWindow($w,0)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\snuyly0m\snuyly0m.cmdline"
        5⤵
        
        PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
      4⤵
      Modifies registry key
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
      4⤵
      Enumerates VirtualBox registry keys
      PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
      4⤵
      Enumerates VirtualBox registry keys
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
      4⤵
      Enumerates VirtualBox registry keys
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
      4⤵
      Looks for VMWare Tools registry key
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
      4⤵
      Looks for VMWare services registry key.
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
      4⤵
      PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
      4⤵
      PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 836B
SHA256 aa93ea64ef66d0a77a693d7da37448f18c4e875a8e6e855cb06cfed4218de721
MD5 98ad46809a452976e26c37aa20486e6e
SHA1 afbddbdab67592cb0de78419c9405f301b8fd1f2
SHA512 2116ca46f36459fc9a1fd884d23ade4b66ca5cc48adbff8b737ddafa10db72d68219c68f4081c81c4a34954d676eb9b3d43d3d41a45ae0ef4601672eefdbed06
TLSH
T1D9017632F34DC930CCA2163A809CAC56733A92DB816ADF9F7FC0C210E09B580CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 300a56ba5d190f01f59e1c51c90ce534d5992014f12fb7cfff4084ee34d4bcc6
MD5 bc0ed8ddedc52bd822f7f7afad3699c1
SHA1 9c26c503956a474b27d187c1c9e284db14eb7cc0
SHA512 f81bd3b9b5313d876cd27ad6e2f390b73d86d716735b37cf4a160e85bea6ad0da80bca92f5106451cbabb5e3f443018e4eb9097b56cf4d0f6cd655f795454d72
TLSH
T1EF115327B39C8921CC96153A409DAC1172B683DB81AEDE9FBFC4D214A07F584CBA12A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 03a9c1ee1610ac667757db120dfb496c1dfe93fb3fe6e25a3805092d19c3349e
MD5 7d62a8b4882bcae55db635f5173a97d9
SHA1 c780200e6e77abadbf872d9493d362ad1ff9342a
SHA512 bf3b4cfec8ecf7010ff261bc5eb5d1ab27be5f4cafd73e9fcf6b65dfb340afb27ff77dd26ddb94f7183cd69ac43281bbb3a4afef34ccc306fdd0ca1950fd61eb
TLSH
T138218727B39CC921CC99153A209CAD1172B683C7809ECF8F6FC0D225A57FAC4CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31bd5a28190599cf85382a7a9a438e8cf8dd7897181d9fd270827ea4fb4545ba
MD5 371e7ee6c059cbe909fb920a5fbdc79b
SHA1 748b6dd17f5fe32b309ff9910e84c77a3f6a8092
SHA512 036e660355198776e712c6159c378abb32a2b8fb7335c43bbd80124affc35caa6caabec6f83c9cb7901983efcbf2d658aa68526e62c67ec7eb1460d87ef97f9c
TLSH
T1D7216527B39CD9A1CC95253A209CAC1172B783C7809ECF8F6AC0D224A57FAD8CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uvw5scnm.f3r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uvw5scnm.f3r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

snuyly0m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\snuyly0m\snuyly0m.0.cs
Size 268B
SHA256 d02d27860f48db9e87b57383e7206aeaeab2e37fc66317b421741117190afdda
MD5 681f8a59a77ca19fb636bc66e5c51d34
SHA1 30c62c3f6a3902b79ca8eb804f991085df73bd68
SHA512 33e461c8ee5a7355bb61ce197c6308c9533c9b4fb2b52277b904e9f08dea3b0093d83823a811011d54ad8ec2f91a2302e5fe840910c5111f4f7fba12d2e8f962
TLSH
T104D02B147AB3CB64001348164D46B1FCFA03812632B92A00B6E85310DF470095136A1A
MD5 SHA1 SHA512 TLSH

Submit Download

snuyly0m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\snuyly0m\snuyly0m.cmdline
Size 369B
SHA256 3c5b2af05bb8f47623e6ddecb0d1e5b721dbb1d4862f3e84fc026c9a1bffe250
MD5 e8803929889cf07f9787fc83bed01e3a
SHA1 d1575809a8a5a0617350b8c42dd2998ba9483571
SHA512 d6cb4fc221fe9c957b695049e43d71259e2265d180b54de55083f422bde303a9c8811318c52fccae890928ed7ad43e778bf363e31de05746d12e40fb65afad4d
TLSH
T1F2E0C66E6246C27D82ED201B227EF4BCD2B2078329823F849049842DE0270103BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-29-0x0000023B415B0000-0x0000023B41629000-memory.dmp

Download

memory/1376-2-0x000002AEDD560000-0x000002AEDD582000-memory.dmp

Download

memory/4352-38-0x0000023BF10F0000-0x0000023BF111A000-memory.dmp

Download

memory/4352-39-0x0000023BF10F0000-0x0000023BF1114000-memory.dmp

Download