56b2e827a8553d0ef48555984de1326e3de466a30d50ef7f8ca833fb28ef1567

Analysis

max time kernel
150s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.2MB
Sample260518-vx44dsav41
SHA256 56b2e827a8553d0ef48555984de1326e3de466a30d50ef7f8ca833fb28ef1567
MD5 091bce8fdb606938b0135ccc2f279b33
SHA1 4d34d352faf7ad606b57b3b2e2e03f95470aeeb9
SHA512 6d01267188b654a4e393d2ce6ddb6025ff17f2b92a1c08d6f957755225698fc5efd15a68e86e80200fe8f8c35a3d2c253d59d4c9814bbbbaec6415b62b01f874
SSDEEP 24576:jvRAx6rOrM8gkpyxi6FwZa7afvFFFLChKMdDBbPjXbz:HOrXT6Ca4FFFOhKMdDBXr
TLSH
T17B555BC3B29401E4C8AB97305853463ADBB37C2A47A087DB1A54765E3F3A6D51F3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5796 created 776	5796	svchost.exe	14

Executes dropped EXE 2 IoCs

pid	Process
432	vys0jqd2.5fp.exe
4128	fynbzu1r.ayv.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 20 May 2026 09:46:33 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1779270393"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={7253B11C-499F-4633-BA40-00F835932CC7}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3612	SCHTASKS.exe
1828	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe
432	vys0jqd2.5fp.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4364	Process not Found
5232	Process not Found
1664	Process not Found
5244	Process not Found
1788	Process not Found
1188	Process not Found
3008	Process not Found
572	Process not Found
1164	Process not Found
2476	Process not Found
2168	Process not Found
5816	Process not Found
4496	Process not Found
5576	Process not Found
1384	Process not Found
3360	Process not Found
5452	Process not Found
6072	Process not Found
5404	Process not Found
3356	Process not Found
1124	Process not Found
3024	Process not Found
388	Process not Found
244	Process not Found
4564	Process not Found
5308	Process not Found
5708	Process not Found
5856	Process not Found
2328	Process not Found
3412	Process not Found
3536	Process not Found
3912	Process not Found
684	Process not Found
6088	Process not Found
5776	Process not Found
5608	Process not Found
5424	Process not Found
5360	Process not Found
2888	Process not Found
5492	Process not Found
2096	Process not Found
1528	Process not Found
3524	Process not Found
1592	Process not Found
2744	Process not Found
2368	Process not Found
648	Process not Found
2616	Process not Found
5604	Process not Found
5276	Process not Found
876	Process not Found
1648	Process not Found
4524	Process not Found
4628	Process not Found
2940	Process not Found
1540	Process not Found
5756	Process not Found
2936	Process not Found
5464	Process not Found
4904	Process not Found
5696	Process not Found
5764	Process not Found
804	Process not Found
5800	Process not Found

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	432	vys0jqd2.5fp.exe
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeAuditPrivilege	2756	svchost.exe
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3284	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 432	5220	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80
PID 5220 wrote to memory of 3612	5220	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	81
PID 432 wrote to memory of 636	432	vys0jqd2.5fp.exe	5
PID 432 wrote to memory of 688	432	vys0jqd2.5fp.exe	7
PID 432 wrote to memory of 904	432	vys0jqd2.5fp.exe	11
PID 432 wrote to memory of 400	432	vys0jqd2.5fp.exe	13
PID 432 wrote to memory of 776	432	vys0jqd2.5fp.exe	14
PID 432 wrote to memory of 1040	432	vys0jqd2.5fp.exe	15
PID 432 wrote to memory of 1060	432	vys0jqd2.5fp.exe	16
PID 432 wrote to memory of 1148	432	vys0jqd2.5fp.exe	18
PID 432 wrote to memory of 1152	432	vys0jqd2.5fp.exe	19
PID 432 wrote to memory of 1212	432	vys0jqd2.5fp.exe	20
PID 432 wrote to memory of 1280	432	vys0jqd2.5fp.exe	21
PID 432 wrote to memory of 1296	432	vys0jqd2.5fp.exe	22
PID 432 wrote to memory of 1328	432	vys0jqd2.5fp.exe	23
PID 432 wrote to memory of 1352	432	vys0jqd2.5fp.exe	24
PID 432 wrote to memory of 1464	432	vys0jqd2.5fp.exe	25
PID 432 wrote to memory of 1484	432	vys0jqd2.5fp.exe	26
PID 432 wrote to memory of 1656	432	vys0jqd2.5fp.exe	27
PID 432 wrote to memory of 1708	432	vys0jqd2.5fp.exe	28
PID 432 wrote to memory of 1720	432	vys0jqd2.5fp.exe	29
PID 432 wrote to memory of 1836	432	vys0jqd2.5fp.exe	30
PID 432 wrote to memory of 1868	432	vys0jqd2.5fp.exe	31
PID 432 wrote to memory of 1904	432	vys0jqd2.5fp.exe	32
PID 432 wrote to memory of 1924	432	vys0jqd2.5fp.exe	33
PID 432 wrote to memory of 2032	432	vys0jqd2.5fp.exe	34
PID 432 wrote to memory of 1616	432	vys0jqd2.5fp.exe	35
PID 432 wrote to memory of 1764	432	vys0jqd2.5fp.exe	36
PID 432 wrote to memory of 1600	432	vys0jqd2.5fp.exe	37
PID 432 wrote to memory of 2088	432	vys0jqd2.5fp.exe	38
PID 432 wrote to memory of 2228	432	vys0jqd2.5fp.exe	39
PID 432 wrote to memory of 2320	432	vys0jqd2.5fp.exe	41
PID 432 wrote to memory of 2508	432	vys0jqd2.5fp.exe	42
PID 432 wrote to memory of 2684	432	vys0jqd2.5fp.exe	43
PID 432 wrote to memory of 2692	432	vys0jqd2.5fp.exe	44
PID 432 wrote to memory of 2728	432	vys0jqd2.5fp.exe	45
PID 432 wrote to memory of 2756	432	vys0jqd2.5fp.exe	46
PID 432 wrote to memory of 2812	432	vys0jqd2.5fp.exe	47
PID 432 wrote to memory of 2820	432	vys0jqd2.5fp.exe	48
PID 432 wrote to memory of 2828	432	vys0jqd2.5fp.exe	49
PID 432 wrote to memory of 700	432	vys0jqd2.5fp.exe	51
PID 432 wrote to memory of 1544	432	vys0jqd2.5fp.exe	52
PID 432 wrote to memory of 3112	432	vys0jqd2.5fp.exe	53
PID 432 wrote to memory of 3284	432	vys0jqd2.5fp.exe	54
PID 432 wrote to memory of 3416	432	vys0jqd2.5fp.exe	55
PID 432 wrote to memory of 3436	432	vys0jqd2.5fp.exe	56
PID 432 wrote to memory of 3804	432	vys0jqd2.5fp.exe	59
PID 432 wrote to memory of 3872	432	vys0jqd2.5fp.exe	60
PID 432 wrote to memory of 3928	432	vys0jqd2.5fp.exe	61
PID 432 wrote to memory of 3976	432	vys0jqd2.5fp.exe	62
PID 432 wrote to memory of 4316	432	vys0jqd2.5fp.exe	63
PID 432 wrote to memory of 4416	432	vys0jqd2.5fp.exe	64
PID 432 wrote to memory of 5392	432	vys0jqd2.5fp.exe	67
PID 432 wrote to memory of 3104	432	vys0jqd2.5fp.exe	68
PID 432 wrote to memory of 4724	432	vys0jqd2.5fp.exe	69
PID 432 wrote to memory of 1916	432	vys0jqd2.5fp.exe	71
PID 432 wrote to memory of 2948	432	vys0jqd2.5fp.exe	72
PID 432 wrote to memory of 6084	432	vys0jqd2.5fp.exe	73
PID 432 wrote to memory of 3444	432	vys0jqd2.5fp.exe	74
PID 432 wrote to memory of 3660	432	vys0jqd2.5fp.exe	75
PID 432 wrote to memory of 4148	432	vys0jqd2.5fp.exe	76
PID 432 wrote to memory of 3828	432	vys0jqd2.5fp.exe	77
PID 432 wrote to memory of 5220	432	vys0jqd2.5fp.exe	79
PID 3284 wrote to memory of 900	3284	Explorer.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:776

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-297b57f2-8cf6-4d6f-bad9-c8afe3339458 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8742dde2-cd19-4691-a309-d1458a1257a4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1d1759de-9d8f-4a13-ba4c-d30a4bb08512 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e68a1ecb-a3aa-4f89-97c5-f7a64c6227c8 -LifetimeId:ddbe7489-d15b-4daa-879d-8f18a543c9b4 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1464
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:700
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3000
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2552
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1944
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5000
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3856
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2088

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1544

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Users\Admin\AppData\Local\Temp\vys0jqd2.5fp.exe
    "C:\Users\Admin\AppData\Local\Temp\vys0jqd2.5fp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:432
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3612
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1828
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\fynbzu1r.ayv.exe
    "C:\Users\Admin\AppData\Local\Temp\fynbzu1r.ayv.exe"
    3⤵
    - Executes dropped EXE
    PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3436

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3872

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3976

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1916

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:6084

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3660

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fynbzu1r.ayv.exe

Path C:\Users\Admin\AppData\Local\Temp\fynbzu1r.ayv.exe
Size 1.0MB
SHA256 0cbcb7ec4a042622b0d9d91b18f908e4208e4725ee1fa74a3555c4dcb622cfc1
MD5 e6a59b12c9ff25259178f5645b8749b1
SHA1 e59dc87c158bb02690e577d3d1bdb169cf89eee6
SHA512 25bf745ff9a61d4ad7a02c1fc39f4972941d90ebf2eef07fbc6e7124629e90c28be6191cae35a403ffb7c9e55968371ba2d46bfe807939de5c35909584677160
SSDEEP 24576:5vRAx6rOrM8gkpyxi6FwZa7afvFFFLChKMdDBbPn:pOrXT6Ca4FFFOhKMdDBj
TLSH
T101355BC362A405E4C8ABD7305496457ACAF37C1A4BF046DB1A54B65F2F3A6C91F3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vys0jqd2.5fp.exe

Path C:\Users\Admin\AppData\Local\Temp\vys0jqd2.5fp.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-31-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/400-353-0x0000019C1DB80000-0x0000019C1DBAB000-memory.dmp

Download

memory/400-30-0x0000019C1DB80000-0x0000019C1DBAB000-memory.dmp

Download

memory/400-39-0x0000019C1DB80000-0x0000019C1DBAB000-memory.dmp

Download

memory/432-11-0x00007FFCD5EF0000-0x00007FFCD5FAD000-memory.dmp

Download

memory/432-10-0x00007FFCD7580000-0x00007FFCD7789000-memory.dmp

Download

memory/636-12-0x0000022A32950000-0x0000022A32975000-memory.dmp

Download

memory/636-282-0x0000022A32980000-0x0000022A329AB000-memory.dmp

Download

memory/636-18-0x0000022A32980000-0x0000022A329AB000-memory.dmp

Download

memory/636-14-0x0000022A32980000-0x0000022A329AB000-memory.dmp

Download

memory/688-19-0x000002D7DA580000-0x000002D7DA5AB000-memory.dmp

Download

memory/688-20-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/688-15-0x000002D7DA580000-0x000002D7DA5AB000-memory.dmp

Download

memory/776-24-0x000002BDAF0A0000-0x000002BDAF0CB000-memory.dmp

Download

memory/776-37-0x000002BDAF0A0000-0x000002BDAF0CB000-memory.dmp

Download

memory/776-25-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/904-27-0x000001792A5F0000-0x000001792A61B000-memory.dmp

Download

memory/904-28-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/904-352-0x000001792A5F0000-0x000001792A61B000-memory.dmp

Download

memory/904-38-0x000001792A5F0000-0x000001792A61B000-memory.dmp

Download

memory/1040-40-0x0000026CDA4E0000-0x0000026CDA50B000-memory.dmp

Download

memory/1040-354-0x0000026CDA4E0000-0x0000026CDA50B000-memory.dmp

Download

memory/1040-34-0x0000026CDA4E0000-0x0000026CDA50B000-memory.dmp

Download

memory/1040-35-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1060-49-0x0000020A3BEE0000-0x0000020A3BF0B000-memory.dmp

Download

memory/1060-44-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1060-356-0x0000020A3BEE0000-0x0000020A3BF0B000-memory.dmp

Download

memory/1060-43-0x0000020A3BEE0000-0x0000020A3BF0B000-memory.dmp

Download

memory/1148-357-0x00000251CB740000-0x00000251CB76B000-memory.dmp

Download

memory/1148-47-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1148-50-0x00000251CB740000-0x00000251CB76B000-memory.dmp

Download

memory/1148-46-0x00000251CB740000-0x00000251CB76B000-memory.dmp

Download

memory/1152-360-0x000002366FCD0000-0x000002366FCFB000-memory.dmp

Download

memory/1152-55-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1152-61-0x000002366FCD0000-0x000002366FCFB000-memory.dmp

Download

memory/1152-54-0x000002366FCD0000-0x000002366FCFB000-memory.dmp

Download

memory/1212-57-0x0000013BC49D0000-0x0000013BC49FB000-memory.dmp

Download

memory/1212-62-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1212-87-0x0000013BC49D0000-0x0000013BC49FB000-memory.dmp

Download

memory/1212-358-0x0000013BC49D0000-0x0000013BC49FB000-memory.dmp

Download

memory/1280-128-0x0000028E5DEE0000-0x0000028E5DF0B000-memory.dmp

Download

memory/1280-361-0x0000028E5DEE0000-0x0000028E5DF0B000-memory.dmp

Download

memory/1280-58-0x0000028E5DEE0000-0x0000028E5DF0B000-memory.dmp

Download

memory/1280-59-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1296-362-0x000001E407B20000-0x000001E407B4B000-memory.dmp

Download

memory/1296-129-0x000001E407B20000-0x000001E407B4B000-memory.dmp

Download

memory/1296-66-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1296-65-0x000001E407B20000-0x000001E407B4B000-memory.dmp

Download

memory/1328-85-0x000001F59F120000-0x000001F59F14B000-memory.dmp

Download

memory/1328-363-0x000001F59F120000-0x000001F59F14B000-memory.dmp

Download

memory/1328-86-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1328-132-0x000001F59F120000-0x000001F59F14B000-memory.dmp

Download

memory/1352-364-0x0000014EE06E0000-0x0000014EE070B000-memory.dmp

Download

memory/1352-89-0x0000014EE06E0000-0x0000014EE070B000-memory.dmp

Download

memory/1352-90-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1352-134-0x0000014EE06E0000-0x0000014EE070B000-memory.dmp

Download

memory/1464-365-0x000001CE113D0000-0x000001CE113FB000-memory.dmp

Download

memory/1464-92-0x000001CE113D0000-0x000001CE113FB000-memory.dmp

Download

memory/1464-93-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1464-135-0x000001CE113D0000-0x000001CE113FB000-memory.dmp

Download

memory/1484-95-0x000001609EE00000-0x000001609EE2B000-memory.dmp

Download

memory/1484-136-0x000001609EE00000-0x000001609EE2B000-memory.dmp

Download

memory/1484-366-0x000001609EE00000-0x000001609EE2B000-memory.dmp

Download

memory/1484-96-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1600-124-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1600-122-0x0000018701FC0000-0x0000018701FEB000-memory.dmp

Download

memory/1616-119-0x0000023A7E630000-0x0000023A7E65B000-memory.dmp

Download

memory/1616-120-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1656-367-0x000001F9D8AD0000-0x000001F9D8AFB000-memory.dmp

Download

memory/1656-137-0x000001F9D8AD0000-0x000001F9D8AFB000-memory.dmp

Download

memory/1656-98-0x000001F9D8AD0000-0x000001F9D8AFB000-memory.dmp

Download

memory/1656-99-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1708-368-0x000002631F070000-0x000002631F09B000-memory.dmp

Download

memory/1708-102-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1708-101-0x000002631F070000-0x000002631F09B000-memory.dmp

Download

memory/1708-138-0x000002631F070000-0x000002631F09B000-memory.dmp

Download

memory/1720-359-0x000001A07C9B0000-0x000001A07C9DB000-memory.dmp

Download

memory/1720-145-0x000001A07C9B0000-0x000001A07C9DB000-memory.dmp

Download

memory/1720-105-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1720-104-0x000001A07C9B0000-0x000001A07C9DB000-memory.dmp

Download

memory/1764-143-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1764-142-0x000002043EAE0000-0x000002043EB0B000-memory.dmp

Download

memory/1836-148-0x0000022039570000-0x000002203959B000-memory.dmp

Download

memory/1836-140-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1836-371-0x0000022039570000-0x000002203959B000-memory.dmp

Download

memory/1836-139-0x0000022039570000-0x000002203959B000-memory.dmp

Download

memory/1868-107-0x0000025FE18C0000-0x0000025FE18EB000-memory.dmp

Download

memory/1868-146-0x0000025FE18C0000-0x0000025FE18EB000-memory.dmp

Download

memory/1868-108-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1868-369-0x0000025FE18C0000-0x0000025FE18EB000-memory.dmp

Download

memory/1904-370-0x0000023A41530000-0x0000023A4155B000-memory.dmp

Download

memory/1904-113-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/1904-147-0x0000023A41530000-0x0000023A4155B000-memory.dmp

Download

memory/1904-110-0x0000023A41530000-0x0000023A4155B000-memory.dmp

Download

memory/1924-111-0x00000277B5B70000-0x00000277B5B9B000-memory.dmp

Download

memory/1924-112-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/2032-117-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/2032-116-0x0000021313CB0000-0x0000021313CDB000-memory.dmp

Download

memory/2088-126-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/2088-123-0x000001D1595D0000-0x000001D1595FB000-memory.dmp

Download

memory/2228-130-0x0000000001A20000-0x0000000001A4B000-memory.dmp

Download

memory/2228-131-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/2320-156-0x0000025D47B70000-0x0000025D47B9B000-memory.dmp

Download

memory/2320-157-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/2508-160-0x00007FFC97610000-0x00007FFC97620000-memory.dmp

Download

memory/2508-159-0x00000157EB4A0000-0x00000157EB4CB000-memory.dmp

Download

memory/2684-162-0x000002ADF4760000-0x000002ADF478B000-memory.dmp

Download

memory/5220-351-0x00000228F97A0000-0x00000228F97B0000-memory.dmp

Download

memory/5220-337-0x00000228F99F0000-0x00000228F9B0C000-memory.dmp

Download

memory/5220-1-0x00000228DDF50000-0x00000228DDF7C000-memory.dmp

Download

memory/5220-0-0x00000228DDA00000-0x00000228DDB40000-memory.dmp

Download