Analysis
- max time kernel
129s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 00:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 10.9MB
- Sample260723-acemsadh47
- SHA256 4a931fee6e3f6f1f4780e13160c0bff9bf5eae64b78690af921e3c521e8a10f0
- MD5 43e46ff3c588c9ccf49a1a0a27c11d98
- SHA1 e216c8e99563103d9b3c924fcefd6d4442088523
- SHA512 559a0b84859bd859baba1dd6859be8964a26b63c037a4fc82628724213853c6d0150a603e24b378840e7bdca6b03447e1599ab7fc3310985642e508ad5f6027d
- SSDEEP 196608:f+LNHs/nDtYdgsHlKargnZqI61lE8mkycvkWkI16cY:foVsvDSVHkaroCfE8hyctwcY
- TLSH T1D8B6BF07EC6914E9D1AED13089769163BB717C891B2123D72B50F6387FB6BE0ADB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c561-98.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 824 powershell.exe 1836 powershell.exe 5964 powershell.exe 4908 powershell.exe 1716 powershell.exe 1260 powershell.exe 4320 powershell.exe 5028 powershell.exe 5864 powershell.exe 4224 powershell.exe 3904 powershell.exe 2348 powershell.exe 3804 powershell.exe 5844 powershell.exe 1728 powershell.exe 2000 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\QKARDrv.sys Dism.exe - Executes dropped EXE 1 IoCs
pid Process 5808 QKARDrv.sys - Loads dropped DLL 6 IoCs
pid Process 5208 MsiExec.exe 5208 MsiExec.exe 5208 MsiExec.exe 5208 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 1052 MsiExec.exe 12 1052 MsiExec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1052 set thread context of 924 1052 MsiExec.exe 121 - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\e593a40.msi msiexec.exe File opened for modification C:\Windows\Installer\e593a40.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4888.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5251.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI49E1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D} msiexec.exe File created C:\Windows\SystemTemp\~DF20F14A65F81AA938.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4A9E.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF07539F7C3BD70ED.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF204E8195E72E7DC1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4EF5.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4ACE.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF654F277ACAD861C3.TMP msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 5844 powershell.exe 5844 powershell.exe 3904 powershell.exe 3904 powershell.exe 4224 powershell.exe 1260 powershell.exe 1260 powershell.exe 1716 powershell.exe 1716 powershell.exe 4224 powershell.exe 824 powershell.exe 824 powershell.exe 5844 powershell.exe 3904 powershell.exe 1716 powershell.exe 1260 powershell.exe 4224 powershell.exe 824 powershell.exe 3196 msiexec.exe 3196 msiexec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 4320 powershell.exe 4320 powershell.exe 1728 powershell.exe 1728 powershell.exe 4320 powershell.exe 5028 powershell.exe 5028 powershell.exe 5028 powershell.exe 2348 powershell.exe 2348 powershell.exe 1836 powershell.exe 1836 powershell.exe 1728 powershell.exe 2348 powershell.exe 1836 powershell.exe 5964 powershell.exe 5964 powershell.exe 4908 powershell.exe 4908 powershell.exe 3804 powershell.exe 3804 powershell.exe 5964 powershell.exe 3804 powershell.exe 5864 powershell.exe 5864 powershell.exe 4908 powershell.exe 2000 powershell.exe 2000 powershell.exe 2000 powershell.exe 5864 powershell.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5844 powershell.exe Token: SeDebugPrivilege 3904 powershell.exe Token: SeDebugPrivilege 4224 powershell.exe Token: SeDebugPrivilege 1260 powershell.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 824 powershell.exe Token: SeIncreaseQuotaPrivilege 3904 powershell.exe Token: SeSecurityPrivilege 3904 powershell.exe Token: SeTakeOwnershipPrivilege 3904 powershell.exe Token: SeLoadDriverPrivilege 3904 powershell.exe Token: SeSystemProfilePrivilege 3904 powershell.exe Token: SeSystemtimePrivilege 3904 powershell.exe Token: SeProfSingleProcessPrivilege 3904 powershell.exe Token: SeIncBasePriorityPrivilege 3904 powershell.exe Token: SeCreatePagefilePrivilege 3904 powershell.exe Token: SeBackupPrivilege 3904 powershell.exe Token: SeRestorePrivilege 3904 powershell.exe Token: SeShutdownPrivilege 3904 powershell.exe Token: SeDebugPrivilege 3904 powershell.exe Token: SeSystemEnvironmentPrivilege 3904 powershell.exe Token: SeRemoteShutdownPrivilege 3904 powershell.exe Token: SeUndockPrivilege 3904 powershell.exe Token: SeManageVolumePrivilege 3904 powershell.exe Token: 33 3904 powershell.exe Token: 34 3904 powershell.exe Token: 35 3904 powershell.exe Token: 36 3904 powershell.exe Token: SeIncreaseQuotaPrivilege 1260 powershell.exe Token: SeSecurityPrivilege 1260 powershell.exe Token: SeTakeOwnershipPrivilege 1260 powershell.exe Token: SeLoadDriverPrivilege 1260 powershell.exe Token: SeSystemProfilePrivilege 1260 powershell.exe Token: SeSystemtimePrivilege 1260 powershell.exe Token: SeProfSingleProcessPrivilege 1260 powershell.exe Token: SeIncBasePriorityPrivilege 1260 powershell.exe Token: SeCreatePagefilePrivilege 1260 powershell.exe Token: SeBackupPrivilege 1260 powershell.exe Token: SeRestorePrivilege 1260 powershell.exe Token: SeShutdownPrivilege 1260 powershell.exe Token: SeDebugPrivilege 1260 powershell.exe Token: SeSystemEnvironmentPrivilege 1260 powershell.exe Token: SeRemoteShutdownPrivilege 1260 powershell.exe Token: SeUndockPrivilege 1260 powershell.exe Token: SeManageVolumePrivilege 1260 powershell.exe Token: 33 1260 powershell.exe Token: 34 1260 powershell.exe Token: 35 1260 powershell.exe Token: 36 1260 powershell.exe Token: SeIncreaseQuotaPrivilege 5844 powershell.exe Token: SeSecurityPrivilege 5844 powershell.exe Token: SeTakeOwnershipPrivilege 5844 powershell.exe Token: SeLoadDriverPrivilege 5844 powershell.exe Token: SeSystemProfilePrivilege 5844 powershell.exe Token: SeSystemtimePrivilege 5844 powershell.exe Token: SeProfSingleProcessPrivilege 5844 powershell.exe Token: SeIncBasePriorityPrivilege 5844 powershell.exe Token: SeCreatePagefilePrivilege 5844 powershell.exe Token: SeBackupPrivilege 5844 powershell.exe Token: SeRestorePrivilege 5844 powershell.exe Token: SeShutdownPrivilege 5844 powershell.exe Token: SeDebugPrivilege 5844 powershell.exe Token: SeSystemEnvironmentPrivilege 5844 powershell.exe Token: SeRemoteShutdownPrivilege 5844 powershell.exe Token: SeUndockPrivilege 5844 powershell.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3196 msiexec.exe 5208 MsiExec.exe 1052 MsiExec.exe 924 Dism.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1404 wrote to memory of 4224 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 1404 wrote to memory of 3904 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 90 PID 1404 wrote to memory of 1260 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 91 PID 1404 wrote to memory of 5844 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 92 PID 1404 wrote to memory of 1716 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93 PID 1404 wrote to memory of 824 1404 2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 98 PID 3196 wrote to memory of 5208 3196 msiexec.exe 103 PID 3196 wrote to memory of 1052 3196 msiexec.exe 104 PID 1052 wrote to memory of 4320 1052 MsiExec.exe 105 PID 1052 wrote to memory of 1728 1052 MsiExec.exe 107 PID 1052 wrote to memory of 5028 1052 MsiExec.exe 109 PID 1052 wrote to memory of 2348 1052 MsiExec.exe 111 PID 1052 wrote to memory of 1836 1052 MsiExec.exe 113 PID 4320 wrote to memory of 5964 4320 powershell.exe 115 PID 5028 wrote to memory of 4908 5028 powershell.exe 116 PID 1728 wrote to memory of 3804 1728 powershell.exe 117 PID 2348 wrote to memory of 2000 2348 powershell.exe 118 PID 1836 wrote to memory of 5864 1836 powershell.exe 119 PID 1052 wrote to memory of 924 1052 MsiExec.exe 121 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_43e46ff3c588c9ccf49a1a0a27c11d98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5FDFE4339F1F3409AB403DF66588AE312⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5208
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7663227C86445CF21052ACAC33BF22602⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5964
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3804
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2000
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5864
-
-
-
C:\windows\system32\Dism.exeC:\windows\system32\Dism.exe3⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:924
-
-
-
C:\Windows\system32\Drivers\QKARDrv.sysC:\Windows\system32\Drivers\QKARDrv.sys1⤵
- Executes dropped EXE
PID:5808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e593a43.rbs
- Size 3KB
- SHA256 2b00d383574946de85f83a89d5922e077a97994cf15fafb578400827c64d8e80
- MD5 941313bf9bcead045182a32f3f461ee4
- SHA1 22c49988ee765018f1b699144356bd88154ee70f
- SHA512 b6ac2f6ac52d2b539b3ca3dcedf264084d8d465adca6e851bb9841f40a7859b6e5751f6c4fbcd1ff2c566c54743b0bc180699e1e7473a1a324b35c63ceb26b7f
- TLSH T18D61B07586C2C2CCD491E9F087E3A0BC8F988D6A5F66E468DE0F4D6D2963140FC1814E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 05a3138d9f2e0a01d89abfd90e281dc68c59b37f3240c9b376819dde06600d1c
- MD5 22c5905f4afad44fdf583d80d32813f9
- SHA1 2746963e649ab54757b4c96264a9113820b2a418
- SHA512 e3bac9e825bc6668aa4ab6858d1ebbad43f8f85025c79529acf7db31ddb8cbe7c47bec8b818e75efaf156e4872aa5737c6b42d97a4df42ddb826a5c7603b4f1f
- TLSH T14E219833B3CC8624CC9A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 deafa9b3e8852cf4be2a715a3432d9605ee0535ccadefa5ae6513ec55b5f2ef4
- MD5 5973fc240c00d57f9352cfac0160a006
- SHA1 318ba77354bcc8157bcbef0fc2df72fd5aa2ecd8
- SHA512 65dd8bf87dabdd6f8ed25c18dc010d8ce40d459ade05fa6f4f839efa3cd858603bd79ac3424de8f386f1c987fa9c86a3ed9461788afc397f523dcf330a8b69a0
- TLSH T142216833B3DD8624C89A413A10CEAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 607a855a62c232a93e82cc73d72034c44632df8733b70c21f9a60ef3091d8b4c
- MD5 65699a3ef365576a827f6e6759abe335
- SHA1 4acfef388564565c7de8d222e0ca71fb4885a458
- SHA512 cfa442dab074d674b66d89aae51361871bf3a611efabe2653872a7c4c3eb6c1638a9ec739bd3c88f1d95299ae98854e2ba58801ff67f53c05a1698ae0881d29a
- TLSH T13A216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 113ea408c0664fd3a975face5cf730aad9f5d5d73441bc7a5ab2fd5a70830dec
- MD5 f8ae74e2109b4740fff7ad9d14f1cd9a
- SHA1 ec70d43cd4355d434c686cc4232ad013e7133856
- SHA512 404b3e869ea826fc41374bb68a367aec9e887cd98b50189906cfe81b0bb4190f94a254e7db25bbd977d753b948e8ab4af404d89c972bd1d1d7b998ee7b10ad05
- TLSH T16C216833B3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 3fc029a78e0ad91ade2dce8a4f7fe27558eef5aa52fcad2233eee177d0f49cad
- MD5 a61384a6b335aeec0595307bd897cb45
- SHA1 c48ba38de5fc4baaa27bec4bbd57211c1e962951
- SHA512 f177abfce8f0e2a629477df5cbc9101d11e985b50fae34db4c47deba18e6c6ee5fb054629dd929910e39afe9e831c184349991ad342268cf2afcc80111501803
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 178d7eeaec5054ab43fe91a3d1664d9e217d078bfdbc7718a5971e2d68707304
- MD5 55c143e00f86b9eaf26900ddd242ceee
- SHA1 5d9444188d988e27d17b5c0f6df841bfdcc141fd
- SHA512 9b3696af09a6b01886b904d495dce10b90ec6f0714c57aa821bec8eb14563d1d7a1d378d50250afa24239585796b1b25910ed81138c173dc7994b143fbd46429
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 72f6c9dbf5872e8d4e57af41e389215fbc823184028acb4bd567e98cd4542d8e
- MD5 c3426c9f53534e69f43ebc72a1a2cf52
- SHA1 3e89b9018b9f43dc956ca06e48875b39c7434017
- SHA512 d2d3ae1326e31534fe8147fa2b8b14ded5766e5b1326a96e61cb7063bf2957325bfe2603d537191f9ae3f0f6e3024c689293f81debed076b98a7dbb2aead9ea6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 744383017be6a53ec45127957d9c822a124503a8573696d6d2a6709b8916332d
- MD5 a27c8727967a5810efaa661ca20bf7b8
- SHA1 28d7bda12a7b49587a7d6389f6d4dfa479dbb8a3
- SHA512 d0433ffaf48211d2af30b9b124dc53670f9ab434aadbf9d70f3c3cf54c84a2c8faedc2f1e8e352d4e0353fe3a45d3d028b70fa7cea87892039507363cdb944bc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
- MD5 78b9021e0576c01ec958b87ec52832c1
- SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
- SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
- TLSH T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2boc3hxe.php.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- Size 402KB
- SHA256 738150b6b28f6052c0f0460df170fb0218989e36a2b3095e0183e06186be619e
- MD5 c365ed2ae150a4697a4f83a557323f7f
- SHA1 9e00836d8872b19824746d75aed11546d80a26b0
- SHA512 9d6711c4e4b8cd493c86d114967e534c8119dd4e81a68de9051231bd4393cdcd5109e4456396b89aa159708dcc756234c4e9fdd9425f43a2cfca41db107ef387
- SSDEEP 12288:PcMmMvDLP6dK+0bIpzrKmrHNt/cwHFGgAG9nTh6ib+6:P17b6dfAIpftt/cgGgL5ThHn
- TLSH T1509423EB17F2E84B49B461C0DE58E7B0CE94318F5DA96943869CE8962AE270C5DDC3C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- Size 440KB
- SHA256 23a4468f3e402b180413cd919286489d4ee3db4eaa6e59c692fc57f691c5353d
- MD5 f4a5b09d0ff2394f787f0823d956c4d5
- SHA1 372a707a62eb14a05ebf487d51b2852503fdf51e
- SHA512 6a63c41a2df752492be0f52eb20e041fdf880e507cbc554a165c8b5e2a881a1275bbf0fcc589919cb585e3f51fd9c45dac1d8ae6d298265b85b8e1df419188ae
- SSDEEP 6144:YBjF+fYit2rKorLNxAtu7sKUj0sxhdeKOi51pblxpxABWbhW/QT01viTURXZm+v/:YBpoYitiKo9RIj/xHeKOiuWtv+iAo+a4
- TLSH T141A4AB67B052C07C29FD4980669A73A70CF582DA06CCCD47A42F997306D9B469FF3E62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI4888.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI5251.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\QKARDrv.sys
- Size 44KB
- SHA256 67fa1b21947b9e89022794afd7ada8fec6615a2de4b6ac4994b45f3d12fd5573
- MD5 b3d2ee44b1906db25ea572cb1d6dbc91
- SHA1 2d2ced069894f8ef114256aa746a1350da9b0e29
- SHA512 ceedcebc67b28c74e04ea2b5cc8fd266c1bb553ee99b54509731d9306db617824a7b9b85b891beb552265da385e39ae66411e586f53e8e3485a9a0e4e84871c8
- SSDEEP 768:UmO1aQiveP0LKn3RS3/QwBoLI21YpdpTxOLk5Q:BO1aQiveMLKn3RS3/QSdc
- TLSH T1F8136C4360C427B4EA22847581C2DC1AE0B578D557B389CF4695F861AAE7BF0EF369C3
- MD5 SHA1 SHA512 SSDEEP TLSH