plusdrop | ec1c638ec0d2afd3fb7e75031d4d1a7271df843b97a9f360f789e1f4f9c64290

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/06/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
Size 71.8MB
Sample260610-a551faby2x
SHA256 ec1c638ec0d2afd3fb7e75031d4d1a7271df843b97a9f360f789e1f4f9c64290
MD5 1af10790a1e43b3a62f28fbb460887fc
SHA1 806c1d36bfbbb61f342fde77872a50ff320fa9c1
SHA512 08385acd0cfd037f4c7e077e9f8d5fda3e8a6da22a3d4332da8253e77a45fb0c7ae0347de6ae9ad705e182fd9a8f5211f51809810b94bb26c434b75e09ca1742
SSDEEP 196608:N5VjSGhrqNLbc+FFmb43OgrRVXrqNblvQkq2QB2TpCjPxTjH+uqBYXAV:N5VHhrqNHcTgrRNrqN/QB2pOxTjyuc
TLSH
T1C7F7C546F605CDCAF86292B8449B8F61A332ECB08760939733A577296FFE78C4DB1544
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt41 apt backdoor defense_evasion discovery execution plusdrop persistence trojan

Malware Config

Signatures

Family: Plusdrop, toughprogress
Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
backdoor plusdrop

Detects Plusdrop Payload 1 IoCs

backdoor apt apt41

resource	yara_rule
behavioral2/memory/4216-557-0x0000022943310000-0x0000022943370000-memory.dmp	family_Plusdrop_payload

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\0AYLpu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
4216	B2FLiV.exe

Loads dropped DLL 1 IoCs

pid	Process
4216	B2FLiV.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3068	icacls.exe
1860	icacls.exe
3176	icacls.exe
1612	icacls.exe
2916	icacls.exe
196	icacls.exe
4684	icacls.exe
4424	icacls.exe
2644	icacls.exe
5080	icacls.exe
3588	icacls.exe
816	icacls.exe
4536	icacls.exe
3140	icacls.exe
2276	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\0AYLpu\\B2FLiV.exe\""	B2FLiV.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
768	cmd.exe
5052	cmd.exe
3424	cmd.exe
1840	cmd.exe
1044	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	B2FLiV.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dRRkm5	B2FLiV.exe
File created	C:\Program Files (x86)\dRRkm5\dRRkm5.exe	B2FLiV.exe
File created	C:\Program Files (x86)\dRRkm5\XPSPLOG.dll	B2FLiV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1296	schtasks.exe
2104	schtasks.exe
4296	schtasks.exe
2600	schtasks.exe
3816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4676	2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe
4216	B2FLiV.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	B2FLiV.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1196	4216	B2FLiV.exe	19
PID 4216 wrote to memory of 1196	4216	B2FLiV.exe	19
PID 4216 wrote to memory of 1344	4216	B2FLiV.exe	99
PID 4216 wrote to memory of 768	4216	B2FLiV.exe	102
PID 768 wrote to memory of 4296	768	cmd.exe	104
PID 1344 wrote to memory of 2276	1344	cmd.exe	105
PID 4216 wrote to memory of 3700	4216	B2FLiV.exe	106
PID 3700 wrote to memory of 1860	3700	cmd.exe	108
PID 4216 wrote to memory of 1328	4216	B2FLiV.exe	22
PID 4216 wrote to memory of 1328	4216	B2FLiV.exe	22
PID 4216 wrote to memory of 3748	4216	B2FLiV.exe	110
PID 4216 wrote to memory of 5052	4216	B2FLiV.exe	113
PID 768 wrote to memory of 3120	768	cmd.exe	112
PID 3748 wrote to memory of 4424	3748	cmd.exe	117
PID 5052 wrote to memory of 2600	5052	cmd.exe	118
PID 768 wrote to memory of 3316	768	cmd.exe	119
PID 5052 wrote to memory of 3140	5052	cmd.exe	120
PID 4216 wrote to memory of 4904	4216	B2FLiV.exe	121
PID 4904 wrote to memory of 2644	4904	cmd.exe	123
PID 5052 wrote to memory of 4576	5052	cmd.exe	124
PID 4216 wrote to memory of 3116	4216	B2FLiV.exe	125
PID 3116 wrote to memory of 3176	3116	cmd.exe	127
PID 4216 wrote to memory of 1516	4216	B2FLiV.exe	26
PID 4216 wrote to memory of 1516	4216	B2FLiV.exe	26
PID 4216 wrote to memory of 4428	4216	B2FLiV.exe	129
PID 4516 wrote to memory of 4668	4516	cmd.exe	131
PID 4428 wrote to memory of 5080	4428	cmd.exe	132
PID 4216 wrote to memory of 4048	4216	B2FLiV.exe	133
PID 4216 wrote to memory of 3424	4216	B2FLiV.exe	135
PID 4048 wrote to memory of 3588	4048	cmd.exe	137
PID 3424 wrote to memory of 3816	3424	cmd.exe	138
PID 4216 wrote to memory of 1476	4216	B2FLiV.exe	139
PID 3424 wrote to memory of 2128	3424	cmd.exe	141
PID 1476 wrote to memory of 1612	1476	cmd.exe	143
PID 3424 wrote to memory of 4464	3424	cmd.exe	144
PID 4216 wrote to memory of 5060	4216	B2FLiV.exe	145
PID 5060 wrote to memory of 816	5060	cmd.exe	147
PID 4216 wrote to memory of 4628	4216	B2FLiV.exe	149
PID 4628 wrote to memory of 4536	4628	cmd.exe	151
PID 4216 wrote to memory of 1804	4216	B2FLiV.exe	30
PID 4216 wrote to memory of 1804	4216	B2FLiV.exe	30
PID 4216 wrote to memory of 424	4216	B2FLiV.exe	152
PID 3020 wrote to memory of 3924	3020	cmd.exe	154
PID 424 wrote to memory of 2916	424	cmd.exe	155
PID 4216 wrote to memory of 1840	4216	B2FLiV.exe	156
PID 4216 wrote to memory of 3396	4216	B2FLiV.exe	158
PID 3396 wrote to memory of 196	3396	cmd.exe	160
PID 1840 wrote to memory of 1296	1840	cmd.exe	161
PID 4216 wrote to memory of 3676	4216	B2FLiV.exe	162
PID 1840 wrote to memory of 2936	1840	cmd.exe	163
PID 3676 wrote to memory of 3068	3676	cmd.exe	166
PID 1840 wrote to memory of 5012	1840	cmd.exe	167
PID 4216 wrote to memory of 664	4216	B2FLiV.exe	168
PID 664 wrote to memory of 4684	664	cmd.exe	170
PID 4216 wrote to memory of 3272	4216	B2FLiV.exe	172
PID 3272 wrote to memory of 3140	3272	cmd.exe	174
PID 1032 wrote to memory of 1692	1032	cmd.exe	175
PID 4216 wrote to memory of 1044	4216	B2FLiV.exe	176
PID 1044 wrote to memory of 2104	1044	cmd.exe	178
PID 1044 wrote to memory of 3840	1044	cmd.exe	179
PID 1044 wrote to memory of 4588	1044	cmd.exe	182
PID 3636 wrote to memory of 4836	3636	cmd.exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1196
- C:\Users\Public\0AYLpu\B2FLiV.exe
  C:\Users\Public\0AYLpu\B2FLiV.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2276
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\0AYLpu\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\0AYLpu\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4296
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3120
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3316
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:1860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:4424
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2600
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3140
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\B2FLiV.exe" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\B2FLiV.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2644
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\B2FLiV.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\B2FLiV.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3176
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\B2FLiV.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\B2FLiV.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:5080
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\adoresd.dat" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\adoresd.dat" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3588
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3816
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2128
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4464
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:1612
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:816
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\msadox.tb" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\msadox.tb" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2916
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1296
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2936
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:196
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\UxEnhance64.dll" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\UxEnhance64.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4684
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\0AYLpu\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\0AYLpu\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3140
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2104
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3840
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4588
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\0AYLpu" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\0AYLpu" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4668
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3924
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1692
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-10_1af10790a1e43b3a62f28fbb460887fc_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_nj.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 dc95e367b5b81ace70b3fe43cfa0366366290c5cd7b25686205d09a0d5a1ac8c
MD5 4cc0fec349444ad219df28854a4caf2d
SHA1 a6213740b49c61612d795a112b457a855c7eea33
SHA512 8d5bddd78e7bcae152206cb069249f5db58881c47cc81895003dfef2a54b4918765b9e9a7253978ab02403fd6462fd2817d5f9437db2cd513f965c89957ab726
TLSH
T14121E9A94A645EC1B7526F577B81D02B7CBA86D074747C1A921A44D909503F8BF0E60C
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 623588a595a010951c52b29a32144cd1db9fe5c7a3ffe80a834c46335ceef66a
MD5 05c4140f5096f7a63bf0c3c7c6fd33e7
SHA1 5d999451eadc84eba45e7508e97612d28abe1a6e
SHA512 93a7b3200fcb8b3a788ea6b9e23a2e8a4c37fa89edb7c6fe7276b83c17fb94fe45c45d5134eac75492bf94194bcc040699642a4fb0348437c763f3a3e789959c
TLSH
T1A721948ADABE0C855F159D860ADCE1776EF58AE418CC084DE507D235BD0539A2F0A13E
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 e1078482088567fd0e70df5034ec3b2655b0264c8882e6d6534e9a080de535d8
MD5 78919de1ba85a894c2980eb0e6a2f522
SHA1 9aa828ecb1db4e47396e8d14b050dad0c012da86
SHA512 e7bc8913d14cee8ad3f2f06a348fc3ec4b3f08769539c30a09161432f2341ac20cc787ceca1b085cb8b053f44c4289b677a5faa448ebb5d397931b085d48c3b1
TLSH
T120F05C2C44BD022FF137CA3D0ACDA962C6B7E611241546A531F54B0E7521F053C5253D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 f38194e74f89eaceffa63ac256a5ba1694b68924b8e46eb0ec13efa3efe3234b
MD5 0a7d8e103009e27db34074d5786a82e2
SHA1 e0c823cf0aaf3ecbc9aa8bbfc899c9859a27526c
SHA512 00f04285a7f7337517cba1d962ff3751a96c0991c77fbbee01b36754499ac820a6f098e2c1e898794bbe551021522433bf6ca149ac87adc127653a39334632fd
TLSH
T12FF05C9469E86019F13BCBBC52E362F5E36BB913685453FF20A652196A52A512C8023C
MD5 SHA1 SHA512 TLSH

Submit Download

B2FLiV.exe

Path C:\Users\Public\0AYLpu\B2FLiV.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\0AYLpu\UxEnhance64.dll
Size 3.1MB
SHA256 4c38a5a8a7b7b5f2b8bc257bc3295915cb91399816fa519063ba14b1f90ac64d
MD5 dba135e982d7578fbb31795347d54d47
SHA1 02d990941ee8224f62d3d799f2cafe59b64d7981
SHA512 dfc17157992646422556953aa56f6f5ea2307fa8aa299084c22015de3084e8ad93389ecc99656eb16b17dd630a5ce32b4fbdc25056488396d58c00032069d774
SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vdG:KmVLh6Kl975jywfnI8vdG
TLSH
T1ADE523A1B6D739F6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\0AYLpu\adoresd.dat
Size 4.7MB
SHA256 c41ba815aca70206f941d363fb7318c8223f83652f6db239480b600ebe0cee80
MD5 a67069569c48e61a66d784d3c108e26c
SHA1 5b704a9e16a9cd1d8af981f98cdec1207b0ada04
SHA512 065afb51aff2879d9447acbd0cf187aad8f8224967b3a2b6e3724105864e94e5cfedfc5ac46817c445991d6cf2de95a8ec19e3860e9295e570d8cfb8cf658f23
SSDEEP 98304:FFvSi0jgcaku9VWBrKaSuMsNxVV0nEgYpBWKPGH8moKtuzoeuTF5Z5eyzvM7T:VVatVNxzgwhPGHboKtGo3ayjE
TLSH
T1653633A972C8CDDA4E6A46DC8A528E670B2A57525361602D1FF00F914BEFE9FDD1C830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\0AYLpu\msadox.tb
Size 8KB
SHA256 c5c8906e10250230707e1864ab2e5f99b44b091d1679c178190c53f55b4698d2
MD5 93d993226eaebd7b6619c0cf8b49ff4e
SHA1 89e4d1165bbd098a2f59bf9fdb362e28ee8e330f
SHA512 e2634e97ab760e5efa66ad02901f3d70141eb8d153d233417726642723688e9ca3911ffc10b278a6eaef20e2c8fe46e6dacb11758f2104ad6da9b1ffd4dec154
SSDEEP 192:JqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:JsZqZOXQ3uqvR2Kfzp
TLSH
T1CA029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4216-546-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-552-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-532-0x00007FFBFFBD0000-0x00007FFBFFBD2000-memory.dmp

Download

memory/4216-576-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-538-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-540-0x00007FFBFFBE0000-0x00007FFBFFBE2000-memory.dmp

Download

memory/4216-545-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-541-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-575-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-547-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-548-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4216-533-0x00007FFBEFC70000-0x00007FFBF0196000-memory.dmp

Download

memory/4216-557-0x0000022943310000-0x0000022943370000-memory.dmp

Download

memory/4216-560-0x00000229449C0000-0x0000022944A66000-memory.dmp

Download

memory/4216-559-0x00000229449C0000-0x0000022944A66000-memory.dmp

Download

memory/4216-558-0x00000229449C0000-0x0000022944A66000-memory.dmp

Download

memory/4216-561-0x00000229449C0000-0x0000022944A66000-memory.dmp

Download

memory/4216-564-0x0000022943DE0000-0x000002294467F000-memory.dmp

Download

memory/4676-526-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4676-504-0x00007FFBFA0F0000-0x00007FFBFA100000-memory.dmp

Download

memory/4676-2-0x0000000000850000-0x000000000085B000-memory.dmp

Download

memory/4676-1-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4676-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4676-527-0x00007FFBFA0F0000-0x00007FFBFA100000-memory.dmp

Download