xbinder | 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766

Analysis

user interaction
yes
max time kernel
61s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 12.1MB
Sample260503-tskzaagw6n
SHA256 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766
MD5 43949f2de3c160b7135a11d4d292b8b3
SHA1 d1346c0bca958e3c225a7653f09cee36d840285a
SHA512 9c7e7c594f8936935de152a7c334b9f19a4fae0d521a23d2e523171bc5b9522c30897109c4e1dd8dfb61cb722031ed0ce60da7a1c088d6e5856b06fee8ce43bc
SSDEEP 196608:GW4NDHH+SJcOpbN5oKesKFewST06Ov5qMoHp9ZHBgdMMwHdzS5sUUTLxD:nsDnFpbHieTo5tolhgdMMwHM5srR
TLSH
T137D633F46AC93974F2EB4B3D73624FE9C9A62725342E02B8E0E4435D8BD7A8D45DC850
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xbinder xworm loader persistence rat trojan

Malware Config

Extracted

Family

xbinder

Mutex

oBySjGJkKWMXO6yKN

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
velocityy.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
Velocity.exe

Extracted

Family

xworm

Version

aferistin-41691.portmap.host:41691

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024425-6.dat	family_xworm
behavioral1/memory/4176-13-0x00000000001A0000-0x00000000001B4000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe
4100	powershell.exe
860	powershell.exe

Checks computer location settings 2 TTPs 24 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	velocityy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Velocity.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\velocityy.lnk	velocityy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\velocityy.lnk	velocityy.exe

Executes dropped EXE 23 IoCs

pid	Process
4176	velocityy.exe
3948	velocityy.exe
1436	velocityy.exe
2476	velocityy.exe
1700	velocityy.exe
4460	velocityy.exe
2256	velocityy.exe
5020	velocityy.exe
2008	velocityy.exe
4996	velocityy.exe
1628	velocityy.exe
4800	velocityy.exe
2264	velocityy.exe
3296	velocityy.exe
1708	velocityy.exe
4372	velocityy.exe
3876	velocityy.exe
1848	velocityy.exe
2032	velocityy.exe
3700	velocityy.exe
3900	velocityy.exe
2296	velocityy.exe
3944	velocityy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\velocityy = "C:\\Users\\Admin\\AppData\\Roaming\\velocityy.exe"	velocityy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
860	powershell.exe
860	powershell.exe
2712	powershell.exe
2712	powershell.exe
4100	powershell.exe
4100	powershell.exe
4176	velocityy.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	velocityy.exe
Token: SeDebugPrivilege	3948	velocityy.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	1436	velocityy.exe
Token: SeDebugPrivilege	4176	velocityy.exe
Token: SeDebugPrivilege	2476	velocityy.exe
Token: SeDebugPrivilege	1700	velocityy.exe
Token: SeDebugPrivilege	4460	velocityy.exe
Token: SeDebugPrivilege	2256	velocityy.exe
Token: SeDebugPrivilege	5020	velocityy.exe
Token: SeDebugPrivilege	2008	velocityy.exe
Token: SeDebugPrivilege	4996	velocityy.exe
Token: SeDebugPrivilege	1628	velocityy.exe
Token: SeDebugPrivilege	4800	velocityy.exe
Token: SeDebugPrivilege	2264	velocityy.exe
Token: SeDebugPrivilege	3296	velocityy.exe
Token: SeDebugPrivilege	1708	velocityy.exe
Token: SeDebugPrivilege	4372	velocityy.exe
Token: SeDebugPrivilege	3876	velocityy.exe
Token: SeDebugPrivilege	1848	velocityy.exe
Token: SeDebugPrivilege	2032	velocityy.exe
Token: SeDebugPrivilege	3700	velocityy.exe
Token: SeDebugPrivilege	3900	velocityy.exe
Token: SeDebugPrivilege	2296	velocityy.exe
Token: SeDebugPrivilege	3944	velocityy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	velocityy.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4176	4448	Velocity.exe	85
PID 4448 wrote to memory of 1116	4448	Velocity.exe	86
PID 1116 wrote to memory of 3948	1116	Velocity.exe	87
PID 1116 wrote to memory of 3164	1116	Velocity.exe	88
PID 4176 wrote to memory of 860	4176	velocityy.exe	89
PID 4176 wrote to memory of 2712	4176	velocityy.exe	91
PID 4176 wrote to memory of 4100	4176	velocityy.exe	93
PID 3164 wrote to memory of 1436	3164	Velocity.exe	95
PID 3164 wrote to memory of 1528	3164	Velocity.exe	97
PID 1528 wrote to memory of 2476	1528	Velocity.exe	99
PID 1528 wrote to memory of 972	1528	Velocity.exe	100
PID 972 wrote to memory of 1700	972	Velocity.exe	101
PID 972 wrote to memory of 2432	972	Velocity.exe	102
PID 2432 wrote to memory of 4460	2432	Velocity.exe	103
PID 2432 wrote to memory of 4912	2432	Velocity.exe	104
PID 4912 wrote to memory of 2256	4912	Velocity.exe	105
PID 4912 wrote to memory of 540	4912	Velocity.exe	106
PID 540 wrote to memory of 5020	540	Velocity.exe	107
PID 540 wrote to memory of 4680	540	Velocity.exe	108
PID 4680 wrote to memory of 2008	4680	Velocity.exe	109
PID 4680 wrote to memory of 5072	4680	Velocity.exe	110
PID 5072 wrote to memory of 4996	5072	Velocity.exe	111
PID 5072 wrote to memory of 1380	5072	Velocity.exe	112
PID 1380 wrote to memory of 1628	1380	Velocity.exe	113
PID 1380 wrote to memory of 3836	1380	Velocity.exe	114
PID 3836 wrote to memory of 4800	3836	Velocity.exe	117
PID 3836 wrote to memory of 1724	3836	Velocity.exe	118
PID 1724 wrote to memory of 2264	1724	Velocity.exe	119
PID 1724 wrote to memory of 1920	1724	Velocity.exe	120
PID 1920 wrote to memory of 3296	1920	Velocity.exe	124
PID 1920 wrote to memory of 1968	1920	Velocity.exe	125
PID 1968 wrote to memory of 1708	1968	Velocity.exe	127
PID 1968 wrote to memory of 4916	1968	Velocity.exe	128
PID 4916 wrote to memory of 4372	4916	Velocity.exe	130
PID 4916 wrote to memory of 4348	4916	Velocity.exe	132
PID 4348 wrote to memory of 3876	4348	Velocity.exe	133
PID 4348 wrote to memory of 1852	4348	Velocity.exe	134
PID 1852 wrote to memory of 1848	1852	Velocity.exe	135
PID 1852 wrote to memory of 688	1852	Velocity.exe	136
PID 688 wrote to memory of 2032	688	Velocity.exe	137
PID 688 wrote to memory of 4024	688	Velocity.exe	138
PID 4024 wrote to memory of 3700	4024	Velocity.exe	139
PID 4024 wrote to memory of 2908	4024	Velocity.exe	140
PID 2908 wrote to memory of 3900	2908	Velocity.exe	143
PID 2908 wrote to memory of 1344	2908	Velocity.exe	144
PID 1344 wrote to memory of 2296	1344	Velocity.exe	145
PID 1344 wrote to memory of 1888	1344	Velocity.exe	146
PID 1888 wrote to memory of 3944	1888	Velocity.exe	147
PID 1888 wrote to memory of 536	1888	Velocity.exe	148

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\velocityy.exe
  "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- C:\Users\Admin\AppData\Local\Temp\Velocity.exe
  "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
    "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
    "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
      "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
      "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        8⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        10⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        11⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        12⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        13⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        14⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        15⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        16⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        17⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        18⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        19⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        20⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        21⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        22⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        23⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        24⤵
        
        PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Velocity.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Velocity.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
TLSH
T1D9F0DD242221E1C489127F111C0D2A4452BF4797B760EE0C7554529FD8312275F203E7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 6aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b
MD5 737aca23f199ce589dd1e68bc4969b98
SHA1 8c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00
SHA512 ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817
TLSH
T104112223F38C8920CC96163A509DAC6172B586CB81EEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
MD5 e58749a7a1826f6ea62df1e2ef63a32b
SHA1 c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA512 4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70
TLSH
T1AC112223F38C8920CC96153A509DAC5172B586CB81AFDE9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ssgdscqy.djj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ssgdscqy.djj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

velocityy.exe

Path C:\Users\Admin\AppData\Local\Temp\velocityy.exe
Size 57KB
SHA256 402dfcad45c1accc395ec18cc56d4dae549f30dfe251bdfbd556d7de42ecdb40
MD5 41e0dc39cc6da98fa73b25326c3cf6a3
SHA1 81c8ca8881a4b44e57df5d39d51f5eacdbdd0769
SHA512 7983cb5a9af5686e678029418a57d6bae3675bf4d2cc5325ffb87b0b8bc4d6ff02dd13a25d306b3b56eb40e982194dc66373d4f3881239a5911b34f44f701271
SSDEEP 1536:mWOYjOFEjXQYoXegGGI20rFcbFZbfZLu6ajV8Ot+Ji:mWmFEGYGo2FZbfYj2OtQi
TLSH
T1EC437C287BE58465D1FF6BB11DE66392D735F3534A13D72F28C8028A1623E88CE417E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-82-0x0000000001500000-0x000000000150C000-memory.dmp

Download

memory/688-121-0x0000000003B70000-0x0000000003B7C000-memory.dmp

Download

memory/860-27-0x0000014E358C0000-0x0000014E358E2000-memory.dmp

Download

memory/860-30-0x0000014E1D0B0000-0x0000014E1D0BC000-memory.dmp

Download

memory/860-31-0x0000014E35920000-0x0000014E3598B000-memory.dmp

Download

memory/972-71-0x0000000002260000-0x000000000226C000-memory.dmp

Download

memory/1116-17-0x0000000003B10000-0x0000000003B20000-memory.dmp

Download

memory/1116-19-0x00000000022D0000-0x00000000022DC000-memory.dmp

Download

memory/1344-131-0x0000000003080000-0x000000000308C000-memory.dmp

Download

memory/1380-92-0x0000000003500000-0x000000000350C000-memory.dmp

Download

memory/1436-67-0x0000000002F50000-0x0000000002F5C000-memory.dmp

Download

memory/1528-68-0x00000000036A0000-0x00000000036AC000-memory.dmp

Download

memory/1628-96-0x0000000001100000-0x000000000110C000-memory.dmp

Download

memory/1700-75-0x0000000001100000-0x000000000110C000-memory.dmp

Download

memory/1708-110-0x0000000001520000-0x000000000152C000-memory.dmp

Download

memory/1724-100-0x0000000002240000-0x000000000224C000-memory.dmp

Download

memory/1848-120-0x0000000001700000-0x000000000170C000-memory.dmp

Download

memory/1852-117-0x0000000003540000-0x000000000354C000-memory.dmp

Download

memory/1888-134-0x0000000001F50000-0x0000000001F5C000-memory.dmp

Download

memory/1920-103-0x00000000015F0000-0x00000000015FC000-memory.dmp

Download

memory/1968-106-0x0000000002280000-0x000000000228C000-memory.dmp

Download

memory/2008-89-0x0000000001450000-0x000000000145C000-memory.dmp

Download

memory/2032-124-0x00000000012C0000-0x00000000012CC000-memory.dmp

Download

memory/2256-81-0x0000000000B80000-0x0000000000B8C000-memory.dmp

Download

memory/2264-104-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

Download

memory/2296-135-0x0000000001050000-0x000000000105C000-memory.dmp

Download

memory/2432-74-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

Download

memory/2476-72-0x0000000001570000-0x000000000157C000-memory.dmp

Download

memory/2712-43-0x00000192E6970000-0x00000192E69DB000-memory.dmp

Download

memory/2712-42-0x00000192E4ED0000-0x00000192E4EDC000-memory.dmp

Download

memory/2908-128-0x0000000001520000-0x000000000152C000-memory.dmp

Download

memory/3164-58-0x0000000003400000-0x000000000340C000-memory.dmp

Download

memory/3296-107-0x00000000008D0000-0x00000000008DC000-memory.dmp

Download

memory/3700-129-0x00000000007C0000-0x00000000007CC000-memory.dmp

Download

memory/3836-95-0x0000000001C30000-0x0000000001C3C000-memory.dmp

Download

memory/3876-118-0x0000000000AC0000-0x0000000000ACC000-memory.dmp

Download

memory/3900-132-0x00000000006F0000-0x00000000006FC000-memory.dmp

Download

memory/3948-57-0x0000000000E10000-0x0000000000E1C000-memory.dmp

Download

memory/4024-123-0x0000000003010000-0x000000000301C000-memory.dmp

Download

memory/4100-54-0x00000241F66D0000-0x00000241F66DC000-memory.dmp

Download

memory/4100-55-0x00000241F6DC0000-0x00000241F6E2B000-memory.dmp

Download

memory/4176-64-0x000000001AF60000-0x000000001AF70000-memory.dmp

Download

memory/4176-79-0x000000001AF60000-0x000000001AF70000-memory.dmp

Download

memory/4176-13-0x00000000001A0000-0x00000000001B4000-memory.dmp

Download

memory/4176-84-0x000000001BAA0000-0x000000001BB0B000-memory.dmp

Download

memory/4176-69-0x0000000000960000-0x000000000096C000-memory.dmp

Download

memory/4348-114-0x0000000002180000-0x000000000218C000-memory.dmp

Download

memory/4372-115-0x0000000001390000-0x000000000139C000-memory.dmp

Download

memory/4448-16-0x00000000039E0000-0x00000000039EC000-memory.dmp

Download

memory/4448-1-0x000000001C3E0000-0x000000001C3F0000-memory.dmp

Download

memory/4448-0-0x0000000000C70000-0x0000000001898000-memory.dmp

Download

memory/4460-78-0x00000000016A0000-0x00000000016AC000-memory.dmp

Download

memory/4680-86-0x0000000001610000-0x000000000161C000-memory.dmp

Download

memory/4800-101-0x0000000002940000-0x000000000294C000-memory.dmp

Download

memory/4912-77-0x0000000002130000-0x000000000213C000-memory.dmp

Download

memory/4916-109-0x0000000001D60000-0x0000000001D6C000-memory.dmp

Download

memory/4996-93-0x0000000002C50000-0x0000000002C5C000-memory.dmp

Download

memory/5020-87-0x0000000002D30000-0x0000000002D3C000-memory.dmp

Download

memory/5072-90-0x0000000001670000-0x000000000167C000-memory.dmp

Download