16486dce457024bb3150bb232e5a766773be563448b9bcd2b6bc3b0e96b9adf0

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 43.4MB
Sample260423-ffkwvsa191
SHA256 16486dce457024bb3150bb232e5a766773be563448b9bcd2b6bc3b0e96b9adf0
MD5 6c97a1c7bb0dd01841e4acafe2b5b9a2
SHA1 54185f5f54f3a08b25a4d2bfab3e6152c7bb1f2f
SHA512 085c7a8ef058ecc1269f9b9356454f0ed49eabd7b643a2e61631de31eb1a11faf506ffc2507adf0d2a58630643567711ab7d6f7419e315ca550accbf3b302b84
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfD:fMguj8Q4VfvnqFTrYi
TLSH
T1B4A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4516	netsh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3756	powershell.exe
4152	powershell.exe
3136	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3332	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1000	systeminfo.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4496	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4152	powershell.exe
3756	powershell.exe
3756	powershell.exe
4152	powershell.exe
3136	powershell.exe
3136	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeIncreaseQuotaPrivilege	3668	WMIC.exe
Token: SeSecurityPrivilege	3668	WMIC.exe
Token: SeTakeOwnershipPrivilege	3668	WMIC.exe
Token: SeLoadDriverPrivilege	3668	WMIC.exe
Token: SeSystemProfilePrivilege	3668	WMIC.exe
Token: SeSystemtimePrivilege	3668	WMIC.exe
Token: SeProfSingleProcessPrivilege	3668	WMIC.exe
Token: SeIncBasePriorityPrivilege	3668	WMIC.exe
Token: SeCreatePagefilePrivilege	3668	WMIC.exe
Token: SeBackupPrivilege	3668	WMIC.exe
Token: SeRestorePrivilege	3668	WMIC.exe
Token: SeShutdownPrivilege	3668	WMIC.exe
Token: SeDebugPrivilege	3668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3668	WMIC.exe
Token: SeRemoteShutdownPrivilege	3668	WMIC.exe
Token: SeUndockPrivilege	3668	WMIC.exe
Token: SeManageVolumePrivilege	3668	WMIC.exe
Token: 33	3668	WMIC.exe
Token: 34	3668	WMIC.exe
Token: 35	3668	WMIC.exe
Token: 36	3668	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3668	WMIC.exe
Token: SeSecurityPrivilege	3668	WMIC.exe
Token: SeTakeOwnershipPrivilege	3668	WMIC.exe
Token: SeLoadDriverPrivilege	3668	WMIC.exe
Token: SeSystemProfilePrivilege	3668	WMIC.exe
Token: SeSystemtimePrivilege	3668	WMIC.exe
Token: SeProfSingleProcessPrivilege	3668	WMIC.exe
Token: SeIncBasePriorityPrivilege	3668	WMIC.exe
Token: SeCreatePagefilePrivilege	3668	WMIC.exe
Token: SeBackupPrivilege	3668	WMIC.exe
Token: SeRestorePrivilege	3668	WMIC.exe
Token: SeShutdownPrivilege	3668	WMIC.exe
Token: SeDebugPrivilege	3668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3668	WMIC.exe
Token: SeRemoteShutdownPrivilege	3668	WMIC.exe
Token: SeUndockPrivilege	3668	WMIC.exe
Token: SeManageVolumePrivilege	3668	WMIC.exe
Token: 33	3668	WMIC.exe
Token: 34	3668	WMIC.exe
Token: 35	3668	WMIC.exe
Token: 36	3668	WMIC.exe
Token: SeDebugPrivilege	3136	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2856	2488	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	81
PID 2856 wrote to memory of 3944	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	82
PID 2856 wrote to memory of 4020	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	83
PID 3944 wrote to memory of 3756	3944	cmd.exe	87
PID 4020 wrote to memory of 4152	4020	cmd.exe	86
PID 4152 wrote to memory of 4824	4152	powershell.exe	88
PID 2856 wrote to memory of 2244	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	89
PID 2244 wrote to memory of 4840	2244	cmd.exe	91
PID 4840 wrote to memory of 4832	4840	net.exe	92
PID 2856 wrote to memory of 1624	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	93
PID 1624 wrote to memory of 4516	1624	cmd.exe	95
PID 2856 wrote to memory of 2524	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	96
PID 2524 wrote to memory of 3668	2524	cmd.exe	98
PID 2856 wrote to memory of 4228	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	99
PID 4228 wrote to memory of 4496	4228	cmd.exe	101
PID 2856 wrote to memory of 420	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	102
PID 420 wrote to memory of 3332	420	cmd.exe	104
PID 2856 wrote to memory of 2132	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	105
PID 2132 wrote to memory of 1000	2132	cmd.exe	107
PID 2856 wrote to memory of 4996	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	109
PID 4996 wrote to memory of 4836	4996	cmd.exe	111
PID 2856 wrote to memory of 2356	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	112
PID 2356 wrote to memory of 2116	2356	cmd.exe	114
PID 2856 wrote to memory of 5028	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	115
PID 5028 wrote to memory of 1784	5028	cmd.exe	117
PID 2856 wrote to memory of 1692	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	118
PID 1692 wrote to memory of 2688	1692	cmd.exe	120
PID 2856 wrote to memory of 1188	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	121
PID 1188 wrote to memory of 1232	1188	cmd.exe	123
PID 2856 wrote to memory of 3812	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	124
PID 3812 wrote to memory of 3044	3812	cmd.exe	126
PID 2856 wrote to memory of 1780	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	127
PID 1780 wrote to memory of 1684	1780	cmd.exe	129
PID 2856 wrote to memory of 3964	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	130
PID 3964 wrote to memory of 2828	3964	cmd.exe	132
PID 2856 wrote to memory of 3348	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	133
PID 3348 wrote to memory of 3136	3348	cmd.exe	135
PID 2856 wrote to memory of 1596	2856	2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	137
PID 1596 wrote to memory of 4724	1596	cmd.exe	139

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-23_6c97a1c7bb0dd01841e4acafe2b5b9a2_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe "C:\snapshot\Kynix Dualhook Bot\builds\b1e4c90b\kynix.js" --hidden
  2⤵
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command "Add-Type -Name "Window" -Namespace "Console" -MemberDefinition "[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);"; [Console.Window]::ShowWindow((Get-Process -Id $pid).MainWindowHandle, 0)""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Add-Type -Name "Window" -Namespace "Console" -MemberDefinition "[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);"; [Console.Window]::ShowWindow((Get-Process -Id $pid).MainWindowHandle, 0)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport("Kernel32.dll")]public static extern IntPtr GetConsoleWindow();[DllImport("User32.dll")]public static extern bool ShowWindow(IntPtr hWnd,int nCmdShow);';$w=[C.W]::GetConsoleWindow();[C.W]::ShowWindow($w,0)""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport("Kernel32.dll")]public static extern IntPtr GetConsoleWindow();[DllImport("User32.dll")]public static extern bool ShowWindow(IntPtr hWnd,int nCmdShow);';$w=[C.W]::GetConsoleWindow();[C.W]::ShowWindow($w,0)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\50gx1r3m\50gx1r3m.cmdline"
        5⤵
        
        PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4840
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
      4⤵
      Modifies registry key
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
      4⤵
      Enumerates VirtualBox registry keys
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
      4⤵
      Enumerates VirtualBox registry keys
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
      4⤵
      Enumerates VirtualBox registry keys
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
      4⤵
      Looks for VMWare Tools registry key
      PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
      4⤵
      Looks for VMWare services registry key.
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
      4⤵
      PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 92d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
MD5 a766b59cb8764029e0daa42ff2d21c3f
SHA1 9ca2e4735a93ab8ddf2d8e6928f1c570aa4ff80b
SHA512 e92fe19a450bc93cfcbaed70586d580470d239cd41997e0bdebdb45f1b6ba02604b4e839ab6ee40d5112ba683c647ecd10751183ab2f89226994e17680c52eae
TLSH
T1DA117A33B79CC135C8D9157A108DAD01B2B5C3CB049EDE8B7A84C509E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oerihsbh.ye0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oerihsbh.ye0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

50gx1r3m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\50gx1r3m\50gx1r3m.0.cs
Size 268B
SHA256 d02d27860f48db9e87b57383e7206aeaeab2e37fc66317b421741117190afdda
MD5 681f8a59a77ca19fb636bc66e5c51d34
SHA1 30c62c3f6a3902b79ca8eb804f991085df73bd68
SHA512 33e461c8ee5a7355bb61ce197c6308c9533c9b4fb2b52277b904e9f08dea3b0093d83823a811011d54ad8ec2f91a2302e5fe840910c5111f4f7fba12d2e8f962
TLSH
T104D02B147AB3CB64001348164D46B1FCFA03812632B92A00B6E85310DF470095136A1A
MD5 SHA1 SHA512 TLSH

Submit Download

50gx1r3m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\50gx1r3m\50gx1r3m.cmdline
Size 369B
SHA256 93db4a3dda638e469c4cd63ae1d789d7141e0e490f14a921b589b78634eaa557
MD5 bd5eff856ad46eb1f091e922028d3895
SHA1 38a958a6c70997cf141593e7892ea0568423a3f6
SHA512 4d28f4d365e0644f9435a82a6813259c5db0dd1c2e268279ae928acc1737c1f82246cd1c4c5b33bc860024df69f57515a030be5592f3b20da736699266e1591a
TLSH
T14AE0C66A4346CA7D01EE100B2F7AC6ECC27207832982BF8C9252842EE0B74002BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1000-46-0x0000027879AA0000-0x0000027879B76000-memory.dmp

Download

memory/3136-45-0x000001D975320000-0x000001D975332000-memory.dmp

Download

memory/3136-44-0x000001D974B70000-0x000001D97531E000-memory.dmp

Download

memory/3136-43-0x000001D95C820000-0x000001D95C82C000-memory.dmp

Download

memory/3756-22-0x00000169A2540000-0x00000169A254C000-memory.dmp

Download

memory/3756-24-0x00000169A25F0000-0x00000169A2602000-memory.dmp

Download

memory/3756-23-0x00000169BACC0000-0x00000169BB46E000-memory.dmp

Download

memory/4152-33-0x000002545ECB0000-0x000002545ECC2000-memory.dmp

Download

memory/4152-32-0x000002545ED20000-0x000002545F4CE000-memory.dmp

Download

memory/4152-2-0x000002545F4D0000-0x000002545F4F2000-memory.dmp

Download

memory/4152-31-0x0000025444DE0000-0x0000025444DEC000-memory.dmp

Download

memory/4824-25-0x00000208CE3F0000-0x00000208CE4C6000-memory.dmp

Download

memory/4824-26-0x00000208CE660000-0x00000208CE66C000-memory.dmp

Download