Drops startup file

Executes dropped EXE

Loads dropped DLL

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

System Binary Proxy Execution: Rundll32

Abuse Rundll32 to proxy execution of malicious code.

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Drops desktop.ini file(s)

Hide Artifacts: Hidden Window

Windows that would typically be displayed when an application carries out an operation can be hidden.

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection.

Detected potential entity reuse from brand GOOGLE.