5eaa8e97cdbe30f4c106f06f5c8af76b93b1539f98ae1a4c5e96b97ef0e27e25

Analysis

max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
Size 646KB
Sample260531-cf75lsaw2k
SHA256 5eaa8e97cdbe30f4c106f06f5c8af76b93b1539f98ae1a4c5e96b97ef0e27e25
MD5 b1eda90b35eb04638cf1698c2618de7d
SHA1 9c18c54276dc179e83678b17a39372a1c6cdfdec
SHA512 efa039cbfdf441f9dd5f046186f781bb1d7a415e6a20ab7bcf6db2132cc470c82de7e57d28cae26d3d89d9930ce91b6cf4c2d153f3a4252613bab763c586f631
SSDEEP 12288:ZBWfqCHQZtvpBabWLwugwhqUzKwv8f97Bd6eJWfezrBTxfwxRFoqnL5HgmdAaNA:DlmShVzKwvS96XGf+fn1HlN
TLSH
T174E4F171B7D200F8E567867BD9425A26E7F3B41607209BEF17A053262F235CC9D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4808	svchost.exe
2124	msdtc.exe
4152	msdtc.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\phqgoci.dat	svchost.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b755-9.dat	upx
behavioral2/memory/4808-11-0x00007FFE6FB70000-0x00007FFE6FBCE000-memory.dmp	upx
behavioral2/files/0x001900000002b757-13.dat	upx
behavioral2/memory/2124-15-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx
behavioral2/memory/4808-16-0x00007FFE6FB70000-0x00007FFE6FBCE000-memory.dmp	upx
behavioral2/memory/2124-18-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx
behavioral2/memory/4808-31-0x00007FFE6FB70000-0x00007FFE6FBCE000-memory.dmp	upx
behavioral2/memory/2124-32-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx
behavioral2/memory/2124-63-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx
behavioral2/memory/4152-66-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx
behavioral2/memory/4152-75-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx
behavioral2/memory/4152-82-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp	upx

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI455E.tmp	msdtc.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI458E.tmp	msdtc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI454C.tmp	msdtc.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI455D.tmp	msdtc.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI459E.tmp	msdtc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Tasks\SA.DAT	svchost.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	msdtc.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5596	sc.exe
3768	sc.exe
472	sc.exe
5144	sc.exe
4920	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1732	cmd.exe
5420	cmd.exe
3612	PING.EXE
1084	PING.EXE
2376	cmd.exe
5396	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1096	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	msdtc.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 7fae83ada1f0dc01	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\PMDisplayName = "Internet [Protected Mode]"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\CurrentLevel = "0"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1"	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\DisplayName = "Local intranet"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3"	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 = "0"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3"	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\knownfolder = "0"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]"	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer"	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "Computer"	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	msdtc.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\	msdtc.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Flags = "33"	msdtc.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3612	PING.EXE
1084	PING.EXE
5396	PING.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeAuditPrivilege	4808	svchost.exe
Token: SeLockMemoryPrivilege	2124	msdtc.exe
Token: SeLockMemoryPrivilege	4152	msdtc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2124	msdtc.exe
4152	msdtc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 3312	6028	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	80
PID 6028 wrote to memory of 6064	6028	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	81
PID 6028 wrote to memory of 1732	6028	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	82
PID 6028 wrote to memory of 5420	6028	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	83
PID 6064 wrote to memory of 4600	6064	cmd.exe	88
PID 5420 wrote to memory of 3612	5420	cmd.exe	89
PID 4600 wrote to memory of 5596	4600	cmd.exe	90
PID 4600 wrote to memory of 4020	4600	cmd.exe	91
PID 3312 wrote to memory of 3768	3312	cmd.exe	92
PID 1732 wrote to memory of 1084	1732	cmd.exe	93
PID 3312 wrote to memory of 472	3312	cmd.exe	94
PID 6064 wrote to memory of 1096	6064	cmd.exe	95
PID 1732 wrote to memory of 5144	1732	cmd.exe	100
PID 2124 wrote to memory of 2376	2124	msdtc.exe	101
PID 2376 wrote to memory of 5396	2376	cmd.exe	104
PID 2376 wrote to memory of 4920	2376	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop msdtc | sc start msdtc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\sc.exe
    sc stop msdtc
    3⤵
    - Launches sc.exe
    PID:3768
- - C:\Windows\system32\sc.exe
    sc start msdtc
    3⤵
    - Launches sc.exe
    PID:472
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "for /f "tokens=2 delims=: " %i in ('sc queryex Schedule ^| findstr PID') do taskkill /PID %i /F "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex Schedule | findstr PID
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\system32\sc.exe
      sc queryex Schedule
      4⤵
      Launches sc.exe
      PID:5596
  - - C:\Windows\system32\findstr.exe
      findstr PID
      4⤵
      PID:4020
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 1208 /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 && sc start Schedule
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1084
- - C:\Windows\system32\sc.exe
    sc start Schedule
    3⤵
    - Launches sc.exe
    PID:5144
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 && del C:\Users\Admin\AppData\Local\Temp\2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && sc start msdtc
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5396
- - C:\Windows\system32\sc.exe
    sc start msdtc
    3⤵
    - Launches sc.exe
    PID:4920

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WptsExtensions.dll

Path C:\ProgramData\PRhkmz\Java\javapath\WptsExtensions.dll
Size 14.8MB
SHA256 13d2c0f2beacc2561c5a0879ddd5818ac1f9e435ede7aff1357dac5c97040dc1
MD5 bd3080b11eb84e688ad5f1b4e598888f
SHA1 7d32b4b16c7682fc8dff6de32ce188b9850f4d1f
SHA512 d1d5c448e77a89ee64af57fc1f7d5b5d9c99541f163327b6ae41b89de44137913d0e87f5b2daf8d335e7afa6285f96e3a5668740beb4bbcef2d5cad0d93aeda8
SSDEEP 393216:93rl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SVDL:9bpKOxk6lFiPvQ6X
TLSH
T1CAF633161CE9484AF314CD74C80E36161A7F29AD9B4CD1B116B5E1B0E8B09F1FE79B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o.dat

Path C:\ProgramData\o.dat
Size 1.0MB
SHA256 1fa6ed8116c3fb7a2e3c1803efca680dbc74e2753398853c514cfab9092079da
MD5 0b2a699625dd65bc8b678d0b8e7fc06b
SHA1 182b86b0257a0f75a530e81c39274b628d7e2c94
SHA512 f54181c2d045b2209ddafbf7116497f100476c8649a13467dfcbefc049f7a8fb06d632ee8351baccc5aa8c335572dc9739f7aff2a07de37156b30d5fc5a3a061
SSDEEP 24576:V+KD9i/iCVp0eh+YgmblDuEzeUZpSg8MtUQ6nIQW71yuEOpgZ:VXiqo0p8rVPUQgu5p2
TLSH
T1182533907EF1C9CE829957C66E7162DD91B033AA4D0691831F22C998DEA10D63CD9CFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGI454C.tmp

Path C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI454C.tmp
Size 24KB
SHA256 8d7e6cee70d6035c066b93143461d5f636e144373f5c46bc10a8935d306e0737
MD5 dd4f5026aa316d4aec4a9d789e63e67b
SHA1 fe41b70acbcba7aa0b8a606fe82bcfde9a7bf153
SHA512 3f18e86d8d5119df6df0d914ebf43c1a6dadb3fdeff8002940a02d0a3d763e779068a682ee6bafe650b6c371d4be2e51e01759ec5b950eef99db5499e3a6c568
SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsYIF8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSLIzw3VgYJQT
TLSH
T1B2B2C0295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phqgoci.dat

Path C:\Windows\system32\phqgoci.dat
Size 2.7MB
SHA256 c6905aff6a046a09ed8606da995a545a078a8e3c145697e87481b25c42f40034
MD5 695f4546fe6647c879871cb08736e4ff
SHA1 9b30db0a91faab4a8bf362784f0b915e02bcbe4a
SHA512 aa64eb6f47f65d96856a96b491b56a96d538b9e5e3eaaeab3dbc02ec17726e44dad57d85502904846981b1c4967becbb09b67b799ec5a5b396bfff2302e25df9
SSDEEP 49152:s6EbSQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkL+eUYWHsiJNXvkUw:sjRWGoqZ92yVG/uzGNV9HkAVHL/Dw
TLSH
T1D8D533E82E5484D4CD3809B449DB7F33DC0B1912EF47A16C378A914685F3BF6A7A9E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-18-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/2124-61-0x0000025E610D0000-0x0000025E6158F000-memory.dmp

Download

memory/2124-63-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/2124-32-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/2124-34-0x0000025E60990000-0x0000025E609B0000-memory.dmp

Download

memory/2124-35-0x0000025E610D0000-0x0000025E6158F000-memory.dmp

Download

memory/2124-15-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/4152-66-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/4152-70-0x0000021D80000000-0x0000021D804BF000-memory.dmp

Download

memory/4152-72-0x0000021D80000000-0x0000021D804BF000-memory.dmp

Download

memory/4152-71-0x0000021D80000000-0x0000021D804BF000-memory.dmp

Download

memory/4152-69-0x0000021D80000000-0x0000021D804BF000-memory.dmp

Download

memory/4152-68-0x0000021D80000000-0x0000021D804BF000-memory.dmp

Download

memory/4152-75-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/4152-81-0x0000021D80000000-0x0000021D804BF000-memory.dmp

Download

memory/4152-82-0x00007FFE6F640000-0x00007FFE6F6A4000-memory.dmp

Download

memory/4808-31-0x00007FFE6FB70000-0x00007FFE6FBCE000-memory.dmp

Download

memory/4808-16-0x00007FFE6FB70000-0x00007FFE6FBCE000-memory.dmp

Download

memory/4808-11-0x00007FFE6FB70000-0x00007FFE6FBCE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads