Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/06/2026, 19:10
General
- Target loader.exe
- Size 7.2MB
- Sample260605-xvcbpsd16k
- SHA256 6d078ccb15e56dcefb165fe5a3a3e7288f90d932cb12081346d80b8a16ae4061
Score
10/10
Malware Config
Extracted
Family
-
xbinder
Mutex
-
QPUWzlnC8ratTwbLI
Attributes
-
primary_drop_directory
%Temp%
-
primary_execute
true
-
primary_hidden_file
false
-
primary_resource_name
loader.exe
-
secondary_drop_directory
%Temp%
-
secondary_execute
true
-
secondary_hidden_file
false
-
secondary_resource_name
tmp._msedgeDeveloperTask.exe
Signatures
- Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 57 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 56 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"17⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"18⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"19⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"20⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"21⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"22⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"23⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"24⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"25⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"26⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"27⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"28⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"29⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"30⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"31⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"57⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"56⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"55⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"54⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"53⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"52⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"51⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"50⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"49⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"48⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"47⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"46⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"45⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"44⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"43⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"42⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"41⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"40⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"39⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"38⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"37⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"36⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"35⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"34⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"33⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"32⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"31⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"30⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"29⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"28⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"27⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"26⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"25⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"24⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"23⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"22⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"21⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"20⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"19⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"18⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"17⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"16⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"15⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"14⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"13⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"12⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"11⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"10⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"9⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"8⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'tmp._msedgeDeveloperTask.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\msedge.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
loader.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_icneswp3.qo2.ps1
tmp._msedgeDeveloperTask.exe
memory/368-14-0x0000021F0C820000-0x0000021F0C830000-memory.dmp
memory/1004-24-0x000001D534840000-0x000001D534862000-memory.dmp
memory/4704-0-0x000002699B9A0000-0x000002699B9B0000-memory.dmp
memory/4704-1-0x00000269B4830000-0x00000269B4F3C000-memory.dmp
memory/4704-2-0x000002699B9A0000-0x000002699B9B0000-memory.dmp
memory/5028-12-0x0000015C09110000-0x0000015C09120000-memory.dmp
memory/5028-15-0x0000015C09110000-0x0000015C09120000-memory.dmp