3a09ff8229b75df267edce15fab42f52622c50d411c60e366c0c2909a4443f57

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
Size 112.1MB
Sample260517-va77jabs91
SHA256 3a09ff8229b75df267edce15fab42f52622c50d411c60e366c0c2909a4443f57
MD5 cdc9a430836916c2a2d4ebccf27d691e
SHA1 6c897ed6156032fedbc7c641469442ae27657844
SHA512 261920676ee85549cdb0f3dbd42cff4202b77a2d1d83fab50c03d158936f22ed12027a484564691e93590dbf6b68ed75f9eff6fdb336d1d87cc0968ec718bcee
SSDEEP 1572864:9AXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:o3iXtqwb
TLSH
T14E486C43B2A75098E4BBC97592D65323E5337C8A1F3069EF15845B312F73AE09B39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe
2900	powershell.exe
3396	powershell.exe
1468	powershell.exe
2424	powershell.exe
3988	powershell.exe
2108	powershell.exe
3552	powershell.exe
2176	powershell.exe
3480	powershell.exe
3760	powershell.exe
1548	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
6	api.ipify.org

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2108	powershell.exe
2108	powershell.exe
3552	powershell.exe
3552	powershell.exe
2176	powershell.exe
2176	powershell.exe
2900	powershell.exe
2900	powershell.exe
3396	powershell.exe
3396	powershell.exe
3480	powershell.exe
3480	powershell.exe
1468	powershell.exe
1468	powershell.exe
2424	powershell.exe
2424	powershell.exe
3760	powershell.exe
3760	powershell.exe
1548	powershell.exe
1548	powershell.exe
3988	powershell.exe
3988	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeIncreaseQuotaPrivilege	3552	powershell.exe
Token: SeSecurityPrivilege	3552	powershell.exe
Token: SeTakeOwnershipPrivilege	3552	powershell.exe
Token: SeLoadDriverPrivilege	3552	powershell.exe
Token: SeSystemProfilePrivilege	3552	powershell.exe
Token: SeSystemtimePrivilege	3552	powershell.exe
Token: SeProfSingleProcessPrivilege	3552	powershell.exe
Token: SeIncBasePriorityPrivilege	3552	powershell.exe
Token: SeCreatePagefilePrivilege	3552	powershell.exe
Token: SeBackupPrivilege	3552	powershell.exe
Token: SeRestorePrivilege	3552	powershell.exe
Token: SeShutdownPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeSystemEnvironmentPrivilege	3552	powershell.exe
Token: SeRemoteShutdownPrivilege	3552	powershell.exe
Token: SeUndockPrivilege	3552	powershell.exe
Token: SeManageVolumePrivilege	3552	powershell.exe
Token: 33	3552	powershell.exe
Token: 34	3552	powershell.exe
Token: 35	3552	powershell.exe
Token: 36	3552	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeIncreaseQuotaPrivilege	2176	powershell.exe
Token: SeSecurityPrivilege	2176	powershell.exe
Token: SeTakeOwnershipPrivilege	2176	powershell.exe
Token: SeLoadDriverPrivilege	2176	powershell.exe
Token: SeSystemProfilePrivilege	2176	powershell.exe
Token: SeSystemtimePrivilege	2176	powershell.exe
Token: SeProfSingleProcessPrivilege	2176	powershell.exe
Token: SeIncBasePriorityPrivilege	2176	powershell.exe
Token: SeCreatePagefilePrivilege	2176	powershell.exe
Token: SeBackupPrivilege	2176	powershell.exe
Token: SeRestorePrivilege	2176	powershell.exe
Token: SeShutdownPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeSystemEnvironmentPrivilege	2176	powershell.exe
Token: SeRemoteShutdownPrivilege	2176	powershell.exe
Token: SeUndockPrivilege	2176	powershell.exe
Token: SeManageVolumePrivilege	2176	powershell.exe
Token: 33	2176	powershell.exe
Token: 34	2176	powershell.exe
Token: 35	2176	powershell.exe
Token: 36	2176	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeIncreaseQuotaPrivilege	2900	powershell.exe
Token: SeSecurityPrivilege	2900	powershell.exe
Token: SeTakeOwnershipPrivilege	2900	powershell.exe
Token: SeLoadDriverPrivilege	2900	powershell.exe
Token: SeSystemProfilePrivilege	2900	powershell.exe
Token: SeSystemtimePrivilege	2900	powershell.exe
Token: SeProfSingleProcessPrivilege	2900	powershell.exe
Token: SeIncBasePriorityPrivilege	2900	powershell.exe
Token: SeCreatePagefilePrivilege	2900	powershell.exe
Token: SeBackupPrivilege	2900	powershell.exe
Token: SeRestorePrivilege	2900	powershell.exe
Token: SeShutdownPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeSystemEnvironmentPrivilege	2900	powershell.exe
Token: SeRemoteShutdownPrivilege	2900	powershell.exe
Token: SeUndockPrivilege	2900	powershell.exe
Token: SeManageVolumePrivilege	2900	powershell.exe
Token: 33	2900	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3984	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	81
PID 3984 wrote to memory of 1912	3984	cmd.exe	83
PID 4348 wrote to memory of 4396	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	84
PID 4396 wrote to memory of 2108	4396	cmd.exe	86
PID 2108 wrote to memory of 2468	2108	powershell.exe	87
PID 4348 wrote to memory of 4576	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	88
PID 4576 wrote to memory of 3552	4576	cmd.exe	90
PID 4348 wrote to memory of 1000	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	92
PID 1000 wrote to memory of 2176	1000	cmd.exe	94
PID 4348 wrote to memory of 1624	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	95
PID 1624 wrote to memory of 2900	1624	cmd.exe	97
PID 4348 wrote to memory of 2660	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	98
PID 2660 wrote to memory of 3396	2660	cmd.exe	100
PID 4348 wrote to memory of 2488	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	101
PID 2488 wrote to memory of 3480	2488	cmd.exe	103
PID 4348 wrote to memory of 852	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	104
PID 852 wrote to memory of 1468	852	cmd.exe	106
PID 4348 wrote to memory of 4596	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	107
PID 4596 wrote to memory of 1900	4596	cmd.exe	109
PID 4348 wrote to memory of 1668	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	110
PID 1668 wrote to memory of 4200	1668	cmd.exe	112
PID 4348 wrote to memory of 2372	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	113
PID 2372 wrote to memory of 2424	2372	cmd.exe	115
PID 4348 wrote to memory of 2356	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	116
PID 2356 wrote to memory of 3760	2356	cmd.exe	118
PID 4348 wrote to memory of 4784	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	119
PID 4784 wrote to memory of 1548	4784	cmd.exe	121
PID 4348 wrote to memory of 3152	4348	2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	122
PID 3152 wrote to memory of 3988	3152	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_cdc9a430836916c2a2d4ebccf27d691e_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\24d4r0tj\24d4r0tj.cmdline"
      4⤵
      PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...